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80386 
HIGH PERFORMANCE MICROPROCESSOR 
WITH INTEGRATED MEMORY MANAGEMENT 


g Flexible 32-Bit Microprocessor mg Hardware Debugging Support 


— 8, 16, 32-Bit Data Types = Optni 
: : ‘ ptimized for System Performance 
8 General Purpose 32-58 Registers — Pipelined Instruction Execution 


m Very Large Address Space — On-Chip Address Translation Caches 
— 4 Gigabyte Physical — 12.5 and 16 MHz Clock 
— 64 Terabyte Virtual — 32 Megabytes/Sec Bus Bandwidth 
— 4 Gigabyte Maximum Segment Size 


m High Speed Numerics Support via 

gm Integrated Memory Management Unit 80287 and 80387 Coprocessors 
— Virtual Memory Support 
— Optional On-Chip Paging 


— 4 Levels of Protection 
: : — Software: C, PL/M, Assembler 
— Fully Compatible with 80286 System Generation Tools 


m Object Code Compatible with All 8086 — Debuggers: PSCOPE, ICET™-386 


Family Mictoprocessors m High Speed CHMOS III Technology 
gw Virtual 8086 Mode Allows Running of A : 
j @ 132 Pin Grid Array Package 
8086 Software in a Protected and (See Packaging Specification, Order #231369) 
Paged System 


The 80386 is an advanced 32-bit microprocessor designed for applications needing very high performance 
and optimized for multitasking operating systems. The 32-bit registers and data paths support 32-bit addresses 
and data types. The processor addresses up to four gigabytes of physical memory and 64 terabytes (2** 46) of 
virtual memory. The integrated memory management and protection architecture includes address translation 
registers, advanced multitasking hardware and a protection mechanism to support operating systems. In 
addition, the 80386 allows the simultaneous running of multiple operating systems. 


Instruction pipelining, on-chip address translation, a a high bus bandwidth ensure short average instruction 
execution times and high system throughput. The 80386 processor is capable of execution at sustained rates 
of between 3 and 4 million instructions per second. 


The 80386 offers new testability and debugging features. Testability features include a self-test and direct 
access to the page translation cache. Four new breakpoint registers allow conditional or unconditional break- 
point traps on code execution or data accesses, for powerful debugging of even ROM-based systems. 
Object-code compatibility with all iAPX 86 family members (8086, 8088, 80186, 80188, 80286) means the 
80386 offers immediate access to the world’s largest microprocesor software base. 


mu Complete System Development 
Support 
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Figure 1-1. 80386 Pipelined 32-Bit Microarchitecture 
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2. BASE ARCHITECTURE 


2.1 INTRODUCTION 


The 80386 consists of a central processing unit, a 
memory management unit and a bus interface. 


The central processing unit consists of the execu- 
tion unit and instruction unit. The execution unit con- 
tains, the eight 32-bit general purpose registers 
which are used for both address calculation and 
data operations, a 64-bit barrel shifter used to speed 
shift, rotate, multiply, and divide operations. The 
multiply and divide logic uses a 1-bit per cycle. The 
multiply algorithm stops the iteration when the most 
significant bits of the multiplier are all zero. This al- 
lows typical 32-bit multiples to be executed in under 
one microsecond. The instruction ufiit decodes the 
instruction opcodes and stores them in the decoded 
instruction queue for immediate use by the execu- 
tion unit. 


The memory management unit (MMU) consists of a 
segmentation unit and a paging unit. Segmentation 
allows the managing of the logical address space by 
providing an extra addressing component, one that 
allows easy code and data relocatability, and effi- 
cient sharing. The paging mechanism operates be- 
neath and is transparent to the segmentation proc- 
ess, to allow management of the physical address 
space. Each segment is divided into one or more 4K 
byte pages. To implement virtual memory system, 
the 80386 supports full restartability for all page and 
segment faults. 


Memory is organized into one or more variable 
length segments, each up to four gigabytes in size. A 
given region of the linear address space, a segment, 
can have attributes associated with it. These attri- 
butes include its location, size, type (i.e. stack, code 
or data), and protection characteristics. Each task 
on an 80386 can have a maximum of 16,381 seg- 
ments of up to four gigabytes each, thus providing 
64 terabytes (trillion bytes) of virtual memory to each 
task. 


The segmentation unit provides four-levels of pro- 
tection for isolating and protecting applications and 
the operating system from each other. The hardware 
enforced protection allows the design of systems 
with a high degree of integrity. 


The 80386 has two modes of operation: Real Ad- 
dress Mode (Real Mode), and Protected Virtual Ad- 
dress Mode (Protected Mode). In Real Mode the 
80386 operates as a very fast 8086, but with 32-bit 
extensions if desired. Real mode is required primari- 
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ly to setup the processor for Protected Mode opera- 
tion. Protected Mode provides access to the sophis- 
ticated memory management, paging and privilege 
capabilities of the processor. 


Within Protected Mode, software can perform a task 
switch to enter into tasks designated as Virtual 8086 
Mode tasks. Each such task behaves with 8086 se- 
mantics, thus allowing 8086 software (an application 
program, or an entire operating system) to execute. 
The Virtual 8086 tasks can be isolated and protect- 
ed from one another and the host 80386 operating 
system, by the use of paging, and emulation of |/O 
instructions. 


Finally, to facilitate high performance system hard- 
ware designs, the 80386 bus interface offers ad- 
dress pipelining, dynamic data bus sizing, and direct 
Byte Enable signals for each byte of the data bus. 
These hardware features are described fully begin- 
ning in Section 5. 


2.2 REGISTER OVERVIEW 


The 80386 has 32 register resources in the following 
categories: 


General Purpose Registers 
Segment Registers 
Instruction Pointer and Flags 
Control Registers 

System Address Registers 
Debug Registers 

Test Registers. 


The registers are a superset of the 8086, 80186 and 
80286 registers, so all 16-bit 8086, 80186 and 
80286 registers are contained within the 32-bit 
80386. 


Figure 2-1 shows all of 80386 base architecture reg- 
isters, which include the general address and data 
registers, the instruction pointer, and the flags regis- 
ter. The contents of these registers are task-specific, 
so these registers are automatically loaded with a 
new context upon a task switch operation. 


The base architecture also includes six directly ac- 
cessible segments, each up to 4 Gbytes in size. The 
segments are indicated by the selector values 
placed in 80386 segment registers of Figure 2-1. 
Various selector values can be loaded as a program 
executes, if desired. 


GENERAL DATA AND ADDRESS REGISTERS 
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Figure 2-1. 80386 Base Architecture Registers 


The selectors are also task-specific, so the segment 
registers are automatically loaded with new context 
upon a task switch operation. 


The other types of registers Control, System Ad- 
dress, Debug and Test registers are primarily used 
to simplify the design and debugging of operating 
systems. 


2.3 REGISTER DESCRIPTIONS 


2.3.1 General Purpose Registers 


General Purpose Registers: The eight general pur- 
pose registers of 32 bits hold data or address quanti- 
ties. The general registers, Figure 2-2, support data 
operands of 1, 8, 16, 32 and 64 bits, and bit fields of 
1 to 32 bits. They support address operands of 16 
and 32 bits. The 32-bit registers are named EAX, 
EBX, ECX, EDX, ESI, EDI, EBP, and ESP. 
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The least significant 16 bits of the registers can be 
accessed separately. This is done by using the 16- 
bit names of the registers AX, BX, CX, DX, Sl, DI, 
BP, and SP. 


Finally 8-bit operations can individually access the 
lowest byte (bits 0-7) and the higher byte (bits 8- 
15) of general purpose registers AX, BX, CX and DX. 
The lowest bytes are named AL, BL, CL and DL, 
respectively. The higher bytes are named AH, BH, 
CH and DH, respectively. The individual byte acces- 
sibility offers additional flexibility for data operations, 
but is not used for effective address calculation. 
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Figure 2-2. General Registers and Instruction 
Pointer 


2.3.2 Instruction Pointer 


The instruction pointer, Figure 2-2, is a 32-bit regis- 
ter named EIP. EIP holds the offset of the next in- 
struction to be executed. The offset is always rela- 
tive to the base of the code segment (CS). The low- 
er 16 bits (bits 0-15) of EIP contain the 16-bit in- 
struction pointer named IP, which is used by 16-bit 
addressing. 


2.3.3 Flags Register 


The Flags Register is a 32-bit register named 
EFLAGS. The defined bits and bit fields within 
EFLAGS, shown in Figure 2-3, control certain opera- 
tions and indicate status of the 80386. The lower 16 
bits (bit 0-15) of EFLAGS contain the 16-bit flag 
register named FLAGS, which is most useful when 
executing 8086 and 80286 code. 


VM 


RF 


VIRTUAL MODE 
RESUME FLAG 
NESTED TASK FLAG 
1/O PRIVILEGE LEVEL 
OVERFLOW 
DIRECTION FLAG 
INTERRUPT ENABLE 
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Figure 2-3. Flags Register 


(Virtual 8086 Mode, bit 17) 


The VM bit provides Virtual 8086 Mode within 
Protected Mode. If set while the 80386 is in 
Protected Mode, the 80386 will switch to Vir- 
tual 8086 operation, handling segment loads 
as the 8086 does, but generating exception 
13 faults privileged opcodes. The VM bit can 
be set only in Protected Mode, by the IRET 
instruction (if current privilege level = 0) and 
by task switches at any privilege level. The 
VM bit is unaffected by POPF. PUSHF always 
pushes a 0 in this bit, even if executing in 
virtual 8086 Mode. The EFLAGS image 
pushed during interrupt processing or saved 
during task switches will contain a 1 in this bit 
if the interrupted code was executing as a Vir- 
tual 8086 Task. 


(Resume Flag, bit 16) 


The RF flag is used in conjunction with the 
debug register breakpoints or single steps. It 
is checked at instruction boundaries before 
breakpoint processing. When FF is set, it 
causes any debug fault to be ignored on the 
next instruction. RF is then automatically re- 
set at the successful completion of every in- 
struction (no faults are signalled) except the 
IRET instruction, the POPF instruction, and 
JMP, CALL, and INT instructions causing a 
task switch. These instruction set RF to the 
value specified by the memory image. For ex- 
ample, at the end of the breakpoint service 


NT 


1OPL 


routine, the IRET instruction can pop an 
EFLAG image having the RF bit set and re- 
sume the program’s execution at the break- 
point address without generating another 
breakpoint fault on the same location. 


(Nested Task, bit 14) 


This flag applies to Protected Mode. NT is set 
to indicate that the execution of this task is 
nested within another task. If set, it indicates 
that the current nested task’s Task State 
Segment (TSS) has a valid back link to the 
previous task’s TSS. This bit is set or reset by 
control transfers to other tasks. The value of 
NT in EFLAGS is tested by the IRET instruc- 
tion to determine whether to do an inter-task 
return or an intra-task return. A POPF or an 
IRET instruction will affect the setting of this 
bit according to the image popped, at any 
privilege level. 


(Input/Output Privilege Level, bits 12-13) 


This two-bit field applies to Protected Mode. 
IOPL indicates the maximum CPL (current 
privilege level) value permitted to execute I/O 
instructions without generating an exception 
13 fault. It also indicates the maximum CPL 
value allowing alteration of the IF (INTR En- 
able Flag) bit when new values are popped 
into the EFLAG register. POPF and IRET in- 
struction can alter the IOPL field when exe- 
cuted at CPL = 0. Task switches can always 
alter the IOPL field, when the new flag image 
is loaded from the incoming task’s TSS. 


OF 


DF 


TF 


SF 


— SS 


15 


(Overflow Flag, bit 11) 


OF is set if the operation resulted in a signed 
overflow. Signed overflow occurs when the 
operation resulted in carry/borrow into the 
sign bit (high-order bit) of the result but did 
not result in a carry/borrow out of the high- 
order bit, or vice-versa. For 8/16/32 bit oper- 
ations, OF is set according to overflow at bit 
7/15/31, respectively. 


(Direction Flag, bit 10) 


DF defines whether ESI and/or EDI registers 
postdecrement or postincrement during the 
string instructions. Postincrement occurs if 
DF is reset. Postdecrement occurs if DF is 
set. 


(INTR Enable Flag, bit 9) 


The IF flag, when set, allows recognition of 
external interrupts signalled on the INTR pin. 
When IF is reset, external interrupts signalled 
on the INTR are not recognized. IOPL indi- 
cates the maximum CPL value allowing alter- 
ation of the IF bit when new values are 
popped into EFLAGS or FLAGS. 


(Trap Enable Flag, bit 8) 


TF controls the generation of exception 1 
trap when single-stepping through code. 
When TF is set, the 80386 generates an ex- 
ception 1 trap after the next instruction is exe- 
cuted. When TF is reset, exception 1 traps 
occur only as a function of the breakpoint ad- 
dresses loaded into debut registers DRO- 
DR3. 


(Sign Flag, bit 7) 
SF is set if the high-order bit of the result is 
set, it is reset otherwise. For 8-, 16-, 32-bit 


operations, SF reflects the state of bit 7, 15, 
31 respectively. 


SEGMENT 
REGISTERS 


Physical Base Address Segment Limit 
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(Zero Flag, bit 6) 


ZF is set if all bits of the result are 0. Other- 
wise it is reset. 


(Auxiliary Carry Flag, bit 4) 


The Auxiliary Flag is used to simplify the addi- 
tion and subtraction of packed BCD quanti- 
ties. AF is set if the operation resulted in a 
carry out of bit 3 (addition) or a borrow into bit 
3 (subtraction). Otherwise AF is reset. AF is 
affected by carry out of, or borrow into bit 3 
only, regardless of overall operand length: 8, 
16 or 32 bits. 


(Parity Flags, bit 2) 


PF is set if the low-order eight bits of the op- 
eration contains an even number of “1’s” 
(even parity). PF is reset if the low-order eight 
bits have odd parity. PF is a function of only 
the low-order eight bits, regardless of oper- 
and size. 


(Carry Flag, bit 0) 


CF is set if the operation resulted in a carry 
out of (addition), or a borrow into (subtraction) 
the high-order bit. Otherwise CF is reset. For 
8-, 16- or 32-bit operations, CF is set accord- 
ing to carry/borrow at bit 7, 15 or 31, respec- 
tively. 


Note in these descriptions, ‘‘set’’ means “set to 1,” 
and “reset” means “reset to 0.” 


2.3.4 Segment Registers 


Six 16-bit segment registers hold segment selector 
values identifying the currently addressable memory 
segments. Segment registers are shown in Figure 2- 
4. In Protected Mode, each segment may range in 
size from one byte up to the entire linear and physi- 


DESCRIPTOR REGISTERS (LOADED AUTOMATICALLY) 
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Other 
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Figure 2-4. 80386 Segment Registers, and Associated Descriptor Registers 
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cal space of the machine, 4 Gbytes (232 bytes). In 
Real Address Mode, the maximum segment size is 
fixed at 64 Kbytes (216 bytes). 


The six segments addressable at any given moment 
are defined by the selector registers CS, SS, DS, ES, 
FS and GS. The selector in CS indicates the current 
code segment; the selector in SS indicates the cur- 
rent stack segment; the selectors in DS, ES, FS and 
GS indicate the current data segments. 


2.3.5 Segment Descriptor Registers 


The segment descriptor registers are not-program- 
mer visible, yet it is very useful to understand their 
content. Inside the 80386, a descriptor register (pro- 
grammer invisible) is associated with each program- 
mer-visible segment register, as shown by Figure 2- 
4. Each descriptor register holds a 32-bit segment 
base address, a 32-bit segment limit, and the other 
necessary segment attributes. 


When a selector value is loaded into a segment reg- 
ister, the associated descriptor register is automati- 
cally updated with the correct information. In Real 
Address Mode, only the base address is updated 
directly (by shifting the selector value four bits to the 
left), since the segment maximum limit and attributes 
are fixed in Real Mode. In Protected Mode, the base 
address, the limit, and the attributes are all updated 
per the contents of the segment descriptor indexed 
by the selector. 


Whenever a memory reference occurs, the segment 
descriptor register associated with the segment be- 
ing used is automatically involved with the memory 
reference. The 32-bit segment base address be- 
comes a component of the linear address calcula- 
tion, the 32-bit limit is used for the limit-check opera- 
tion, and the attributes are checked against the type 
of memory reference being requested. 
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2.3.6 Control Registers 


The 80386 has three control registers of 32 bits, 
CRO, CR2 and CR3, to hold machine state of a glob- 
al nature (not specific to an individual task). These 
registers, along with System Address Registers de- 
scribed in the next section, hold machine state that 
affects all tasks in the system. To access the Con- 
trol Registers, load and store instructions are de- 
fined. 


CRO: Machine Control Register (includes 80286 
Machine Status Word) 


CRO, shown in Figure 2-5, contains 6 defined bits for 
control and status purposes. The low-order 16 bits 
of CRO are also known as the Machine Status Word, 
MSW, for compatibility with 80286 Protected Mode. 
LMSW and SMSW instructions are taken as special 
aliases of the load and store CRO operations, where 
only the low-order 16 bits of CRO are involved. For 
compatibility with 80286 operating systems the 
80386’s LMSW instructions work in an identical 
fashion to the LMSW instruction ont he 80286. (i.e. It 
only operates on the low-order 16-bits of CRO and it 
ignores the new bits in CRO.) New 80386 operating 
systems should use the MOV CRO, Reg instruction. 


The defined CRO bits are described ahead. 
PG (Paging Enable, bit 31) 


the PG bit is set to enable the on-chip paging 
unit. It is reset to disable the on-chip paging 
unit. 


(Processor Extension Type, bit 4) 


ET indicates the processor extension type (ei- 
ther 80287 or 80387) as detected by the level 
of the ERROR # input following 80386 reset. 
The ET bit may also be set or reset by loading 
CRO under program control if desired. If ET is 
set, the 80387-compatible 32-bit protocol is 
used. If ET is reset, 80287-compatible 16-bit 
protocol is used. 


Note that for strict 80286 compatibility, ET is 
not affected by the LMSW instruction. When 
the MSW or CRO is stored, bit 4 accurately re- 
flects the current state of the ET bit. 


Er 


NOTE: | 0 indicates intel reserved: Do not define; SEE SECTION 2.3.10 


Figure 2-5. Control Register 0 
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TS (Task Switched, bit 3) 


TS is automatically set whenever a task switch 
operation is performed. If TS is set, a coproces- 
sor opcode will cause a Coprocessor Not Avail- 
able trap (exception 7), if the MP bit is also set. 
The trap handler typically saves’ the 
80287/80387 context belonging to a previous 
task, loads the 80287/80387 state belonging 
to the current task, and clears the TS bit before 
returning to the faulting coprocessor opcode. 


EM (Emulate Coprocessor, bit 2) 


The EMulate coprocessor bit is set to cause all 
coprocessor opcodes to generate a Coproces- 
sor Not Available fault (exception 7). It is reset 
to allow coprocessor opcodes to be executed 
on an actual 80287 or 80387 coprocessor (this 
the default case after reset). Note that the 
WAIT opcode is not affected by the EM bit set- 
ting. 
MP (Monitor Coprocessor, bit 1) 


The MP bit is used in conjunction with the TS 
bit to determine if the WAIT opcode will gener- 
ate a Coprocessor Not Available fault (excep- 
tion 7) when TS = 1. When both MP = 1 and 
TS = 1, the WAIT opcode generates a trap. 
Otherwise, the WAIT opcode does not gener- 
ate a trap. Note that TS is automatically set 
whenever a task switch operation is performed. 


PE (Protection Enable, bit 0) 


The PE bit is set to enable the Protected Mode. 
If PE is reset, the processor operates again in 
Real Mode. PE may be set by loading MSW or 
CRO. PE can be reset only by a load into CRO. 
Note that for strict 80286 compatibility, PE can- 
not be reset by the LMSW instruction. 


CR1: reserved 

CR1 is reserved for use in future Intel processors. 
CR2: Page Fault Linear Address 

CR2, shown in Figure 2-6, holds the 32-bit linear ad- 
dress that caused the last page fault detected. The 
error code pushed onto the page fault handler’s 


stack when it is invoked provides additional status 
information on this page fault. 
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CR3: Page Directory Base Address 


CR3, shown in Figure 2-6, contains the physical 
base address of the page directory table. The 80386 
page directory table is always page-aligned 
(4 Kbyte-aligned). Therefore the lowest twelve bits 
of CR3 are ignored when written and they store as 
undefined. 


A task switch through a TSS which changes the 
value in CR3, or an explicit load into CR3 with any 
value, will invalidate all cached page table entries in 
the paging unit cache. 


2.3.7 System Address Registers 


Four special registers are defined to reference the 
tables or segments supported by the 80286/80386 
protection model. These tables or segments are: 


GDT (Global Descriptor Table), 
IDT (Interrupt Descriptor Table), 
LDT (Local Descriptor Table), 
TSS (Task State Segment). 


The addresses of these tables and segments are 
stored in special registers, the System Address and 
System Segment Registers illustrated in Figure 2-7. 
These registers are named GDTR, IDTR, LDTR and 
TR, respecitvely. Section 4 Protected Mode Archi- 
tecture describes the use of these registers. 


GDTR and IDTR 


These registers hold the 32-bit linear base address 
and 16-bit limit of the GDT and IDT, respectively. 


The GDT and IDT segments, since they are global to 
all tasks in the system, are defined by 32-bit linear 
addresses (subject to page translation if paging is 
enabled) and 16-bit limit values. 


[PAGE DIRECTORY easEREcisTeR ooo] oJ] [o[O[O[O] cre 


NOTE: | 0 | indicates Intel reserved: Do not define; SEE SECTION 2.3.10 


Figure 2-6. Control Registers 2 and 3 
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Figure 2-7. System Address and System Segment Registers 


LDTR and TR 


These registers hold the 16-bit selector for the LDT 
segment and the TSS segment, respectively. 


The LDT and TSS segments, since they are task- 
specific segments, are defined by selector values 
stored in the system segment registers. Note that a 
segment descriptor register (programmer-invisible) 
is associated with each system segment register. 


2.3.8 Debug and Test Registers 


Debug Registers: The six programmer accessible 
debug registers provide on-chip support for debug- 
ging. Debug Register CRO-3 specify the four linear 
breakpoints. The Debug Control Register DR6 is 
used to set the breakpoints and the Debug Status 
Register DR7, displays the current state of the 
breakpoints. The use of the debug registers is de- 
scribed in section 2.12 Debugging support. 


DEBUG REGISTERS 
31 0 
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TEST REGISTERS (FOR PAGE CACHE) 
31 0 
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Figure 2-8. Debug and Test Registers 
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Test Registers: Two registers are used to control 
the testing of the RAM/CAM (Content Addressable 
Memories) in the Translation Lookaside Buffer por- 
tion of the 80386. TR6 is the command test register, 
and TR7 is the data register which contains the data 
of the Translation Lookaside buffer test. Their use is 
discussed in section 2.11 Testability. 


Figure 2-8 shows the Debug and Test registers. 


2.3.9 Register Accessibility 


There are a few differences regarding the accessibil- 
ity of the registers in Real and Protected Mode. Ta- 
ble 2-1 summarizes these differences. See Section 
4 Protected Mode Architecture for further details. 


2.3.10 Compatibility 


VERY IMPORTANT NOTE: 
COMPATIBILITY WITH FUTURE PROCESSORS 


In the preceding register descriptions, note cer- 
tain 80386 register bits are undefined. When un- 
defined bits are called out, treat them as fully 
undefined. This is essential for your software 
compatibility with future processors! Follow the 
guidelines below: 


1) Do not depend on the states of any unde- 
fined bits when testing the values of defined 
register bits. Mask them out when testing. 

2) Do not depend on the states of any unde- 


fined bits when storing them to memory or 
another register. 


3) Do not depend on the ability to retain infor- 
mation written into any undefined bits. 


4) When loading registers always load the unde- 
fined bits as zeros. 
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Table 2-1. Register Usage 


Use in 
Real Mode 


Register 


LDTR 


NOTES: 


Use in 
Protected Mode 


Use in 
Virtual Mode 


es 
es 


Y 


PL = 0: The registers can be accessed only when the current privilege level is zero. 
*IOPL: The PUSHF and POPF instructions are made |/O Privilege Level sensitive in Virtual 8086 Mode. 


5) However, registers which have been previ- 
ously stored may be reloaded without mask- 
ing. 


Depending upon the values of undefined regis- 
ter bits will make your software dependent upon 
the unspecified 80386 handling of these bits. De- 
pending on undefined values risks making your 
software incompatible with future processors 
that define usages for the 80386-undefined bits. 
AVOID ANY SOFTWARE DEPENDENCE UPON 
THE STATE OF UNDEFINED 80386 REGISTER 
BITS. 


2.4 INSTRUCTION SET 


2.4.1 Instruction Set Overview 
The instruction set is divided into nine categories of 
operations: 
Data Transfer 
Arithmetic 
Shift/Rotate 
String Manipulation 
Bit Manipulation 
Control Transfer 
High Level Language Support 
Operating System Support 
Processor Control 
These 80386 instructions are listed in Table 2-2. 
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All 80386 instructions operate on either 0, 1, 2, or 3 
operands; where an operand resides in a register, in 
the instruction itself, or in memory. Most zero oper- 
and instructions (e.g. CLI, STI) take only one byte. 
One operand instructions generally are two bytes 
long. The average instruction is 3.2 bytes long. 
Since the 80386 has a 16-byte prefetched instruc- 
tion queue, an average of 5 instructions will be pre- 
fetched. The use of two operands permits the follow- 
ing types of common instructions: 


Register to Register 
Memory to Register 
Immediate to Register 
Memory to Memory 
Register to Memory 
Immediate to Memory. 


The operands can be either 8, 16, or 32 bits long. As 
a general rule, when executing code written for the 
80386 (32-bit code), operands are 8 or 32 bits; when 
executing existing 80286 or 8086 code (16-bit code), 
operands are 8 or 16 bits. Prefixes can be added to 
all instructions which override the default length of 
the operands, (i.e. use 32-bit operands for 16-bit 
code, or 16-bit operands for 32-bit code). 


intel 


2.4.2 80386 Instructions 

Table 2-2a. Data Transfer 
GENERAL PURPOSE 

Move operand 

Push operand onto stack 

Pop operand off stack 

Push all registers on stack 

Pop all registers off stack 

Exchange Operand, Register 

Translate 


OV 
USH 


Uv 


USHA 
OPA 
CHG 


ae 


x< 
S 
+ 


uv 


Clear Carry Flag 


[e) 


” 


extension 

extended 
cow 
CDQ 
IN____|input operand from 1/O space 
Load pointer into E segment register 
Load pointer into F segment register 
LGs 

register 


LAHF 


USHFD_ |Push EFlags onto stack 
POPFD _ |Pop EFlags off stack 
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Table 2-2b. Arithmetic Instructions 


ADDITION 
Add operand 
Add with carry 
Increment operand by 1 
ASCII adjust for addition 
Decimal adjust for addition 
SUBTRACTION 

Subtract operand 
Subtract with borrow 
Decrement operand by 1 
Negate operand 
Compare operands 
ASCII Adjust for subtraction 

MULTIPLICATION 
Multiply Double/Single Precision 
Integer multiply 
ASCII adjust after multiply 


Divide unsigned 
Integer Divide 


ASCII adjust after division 


Table 2-2c. String Instructions 


MOVS Move byte or Word, Dword string 


INS 
Output string to |/O space 

Compare byte or Word, Dword string 
Scan Byte or Word, Dword string 
Load byte or Word, Dword string 
Store byte or Word, Dword string 


REP___| Repeat 


REPE/ 
REPZ 


RENE/ 
REPNZ Repeat while not equal/not zero 


nput string from I/O space 


Repeat while equal/zero 


Table 2-2d. Logical Instructions 
LOGICALS 
“NOT” operand 


INoT | 
AND | “AND” operand 
OR 


“Inclusive OR” operand 


NOT 
AND 
“Exclusive OR” operand 


TEST “Test” operand 


Table 2-2d. Logical Instructions (Continued) 


SHL/SHR | Shift logical left or right 
SAL/SAR | Shift arithmetic left or right 


SHLD/ 
SHRD Double shift left or right 


Table 2-2e. Bit Manipulation Instructions 


Table 2-2f. Program Control Instructions 
ETCC 


A/JNBE | Jump if above/not below nor equal 
AE/JNB | Jump if above or equal/not below 
J 


JB/JNAE | Jump if below/not above nor equal 
JBE/JNA | Jump if below or equal/not above 


JC Jump if carry 
JE/JZ Jump if equal/zero 
J 


JG/JNLE | Jump if greater/not less nor equal 
JGE/JNL | Jump if greater or equal/not less 


J 

L/JNGE | Jump if less/not greater nor equal 

LE/JNG |Jump if less or equal/not greater 
Jump if not carry 
J 
J 
J 
J 


BT 
TS 

BTR 
TC 

BSF 


NE/JNZ | Jump if not equal/not zero 


ump if not overflow 
ump if not parity/parity odd 


ump if not sign 


Jump if overflow 
Jump if parity/parity even 
Jump if Sign 


NP/JPO 


P/JPE 


ay 6a Se Cy a a a Cl<Ion 
n O|zZ z Zz 
n Oo o) 
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Table 2-2f. Program Control Instructions 
(Continued) 


UNCONDITIONAL TRANSFERS 
Call procedure/task 
Return from procedure/task 


CALL 


i 


S|yD 
c 
he] 


MP 


ITERATION CONTROLS 
OOP —_|Loop 


Loop if equal/zero 


EF ele 
fej toxe) 
0/00 
UvUiuvU 
ZiINMm 
m Sa 
~ 


LOOPNZ |Loop if not equal/not zero 
JCXZ JUMP if register CX=0 


INTERRUPTS 
Interrupt if overflow 
Return from Interrupt 
Clear interrupt Enable 
Set Interrupt Enable 
Table 2-2g. High Level Language Instructions 
Check Array Bounds 
ENTER Setup Parameter Block for Entering 


Procedure 
LEAVE 


Leave Procedure 
Table 2-2h. Protection Model 


SGDT Store Global Descriptor Table 
SIDT Store Interrupt Descriptor Table 


VERR/ 
VERW Verify Segment for Reading or Writing 
LMSW Load Machine Status Word (lower 

16 bits of CRO) 


SMSW Store Machine Status Word 


Table 2-2i. Processor Control Instructions 
Di ees 
WAIT Wait until BUSY # negated 


LOCK 


2.5 ADDRESSING MODES 


2.5.1 Addressing Modes Overview 


The 80386 provides a total of 11 addressing modes 
for instructions to specify operands. The addressing 
modes are optimized to allow the efficient execution 
of high level languages such as C and FORTRAN, 
and they cover the vast majority of data references 
needed by high-level languages. 


2.5.2 Register and Immediate Modes 


Two of the addressing modes provide for instruc- 
tions that operate on register or immediate oper- 
ands: 


Register Operand Mode: The operand is located 
in one of the 8-, 32- or 16-bit general registers. 


Immediate Operand Mode: The operand is in- 
cluded in the instruction as part of the opcode. 


2.5.3 Memory Addressing Modes 


The remaining 9 modes provide a mechanism for 
specifying the effective address of an operand. The 
linear address consists of two components: the seg- 
ment base address and an effective address. The 
effective address is calculated by summing any 
combination of the following four address elements: 


DISPLACEMENT: An 8-, or 32-bit immediate value, 
following the instruction. [16-bit displacements can 
be used by preceding the instruction with an address 
prefix.] 


BASE: The contents of any general purpose regis- 
ter. The base registers are generally used by compil- 
ers to point to the start of the local variable area. 


INDEX: The contents of any general purpose regis- 
ter except for ESP. The index registers are used to 
access the elements of an array, or a string of char- 
acters. 


SCALE: The index register’s value can be multiplied 
by a scale factor, either 1, 2, 4 or 8. Scaled index 
mode is especially useful for accessing arrays or 
structures. 


Combinations of these 4 components make up the 9 
additional addressing modes. There is no perform- 
ance penalty for using any of these addressing com- 
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binations, since the effective address calculation is 
pipelined with the execution of other instructions. 
The one exception is the simultaneous use of Base, 
Index, and Displacement components which re- 
quires one additional clock. 


As shown in Figure 2-9, the effective address (EA) of 
an operand is calculated according to the following 
formula. 


EA= Base Reg+ (Index Reg * Scaling) + Displacement 


Direct Mode: The operand’s offset is contained as 
part of the instruction as an 8-, 16- or 32-bit dis- 
placement. 

EXAMPLE: INC Word PTR [500] 


Register Indirect Mode: A BASE or INDEX register 
contains the address of the operand. 
EXAMPLE: MOV [ECX], EDX 


Based Mode: A BASE register’s contents is added 
to a DISPLACEMENT to form the operands offset. 
EXAMPLE: MOV ECX, [EAX+ 24] 


Index Mode: An INDEX register’s contents is added 
to a DISPLACEMENT to form the operands offset. 
EXAMPLE: ADD EAX, TABLE[ESI!] 


Scaled Index Mode: An INDEX register’s contents is 
multiplied by a scaling factor which is added to a 
DISPLACEMENT to form the operands offset. 
EXAMPLE: IMUL EBX, TABLE[ESI*4],7 


Based Index Mode: The contents of a BASE register 
is added to the contents of an INDEX register to 
form the effective address of an operand. 
EXAMPLE: MOV EAX, [ESI] [EBX] 


Based Scaled Index Mode: The contents of an IN- 
DEX register is multiplied by a SCALING factor and 
the result is added to the contents of a BASE regis- 
ter to obtain the operands offset. 

EXAMPLE: MOV ECX, [EDX*8] [EAX] 


Based Index Mode with Displacement: The contents 
of an INDEX Register and a BASE register’s con- 
tents and a DISPLACEMENT are all summed to- 
gether to form the operand offset. 

EXAMPLE: ADD EDX, [ESI] [EBP + OOFFFFFO] 


Based Scaled Index Mode with Displacement: The 
contents of an INDEX register are multiplied by a 
SCALING factor, the result is added to the contents 
of a BASE register and a DISPLACEMENT to form 
the operand’s offset. 

EXAMPLE: MOV EAX, LOCALTABLE[EDI*4] 
[EBP + 80] 
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EFFECTIVE 
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TARGET ADDRESS | 
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Figure 2-9. Addressing Mode Calculations 
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2.5.4 Differences Between 16 and 32 Example: The processor is executing in Real Mode 
Bit Addresses and the programmer needs to access the EAX regis- 


ters. The assembler code for this might be MOV 
In order to provide software compatibility with the | FAX, 32bitMEMORYOP, ASM 386 automatically de- 
80286 and the 8086, the 80386 can execute 16-bit termines that an Operand Size Prefix is needed and 


instructions in Real and Protected Modes. The proc- generates it. 

essor determines the size of the instructions it is ex- be , 
ecuting by examining the D bit in a segment Descrip- Example: The D bit is 0, and the programmer wishes 
tor. If the D bit is 0 then all operand lengths and to use Scaled Index addressing mode to access an 
effective addresses are assumed to be 16 bits long. array. The Address Length Prefix allows the use of 


If the D bit is 1 then the default length for operands 4 MOV DX, TABLE[ESI*2]. The assembler uses an 
and addresses is 32 bits. In Real Mode the default Address Length Prefix since, with D=0, the default 
size for operands and addresses is 16-bits. addressing mode is 16-bits. 


Regardless of the default precision of the operands Example: The D bit is 1, and the program wants to 
or addresses, the 80386 is able to execute either 16 Store a 16-bit quantity. The Operand Length Prefix is 
or 32-bit instructions. This is specified via the use of used to specify only a 16-bit value; MOV MEM16, 
override prefixes. Two prefixes, the Operand Size DX. 

Prefix and the Address Length Prefix, override the 

value of the D bit on an individual instruction basis. 

These prefixes are automatically added by Intel as- 

semblers. 


TE 
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Table 2-3. BASE and INDEX Registers for 16- and 32-Bit Addresses 


BASE REGISTER 
INDEX REGISTER 


BX,BP 
SI,DI 


SCALE FACTOR 
DISPLACEMENT 


none 


0, 8, 16 bits 


32-Bit Addressing 


Any 32-bit GP Register 
Any 32-bit GP Register 


Except ESP 
1,2,4,8 
0, 8, 32 bits 


The OPERAND LENGTH and Address Length Pre- 
fixes can be applied separately or in combination to 
any instruction. The Address Length Prefix does not 
allow addresses over 64K bytes to be accessed in 
Real Mode. An effective address which exceeds 
FFFFH will result in a General Protection Fault. An 
Address Length Prefix only allows the use of the ad- 
ditional 80386 addressing modes. 


When executing 32-bit code, the 80386 uses either 
8-, or 32-bit displacements, and any register can be 
used as base or index registers. When executing 16- 
bit code, the displacements are either 8, or 16 bits, 
and the base and index register conform to the 286 
model. Table 2-3 illustrates the differences. 


2.6 DATA TYPES 


The 80386 supports all of the data types commonly 
used in high level languages: 


Bit: A single bit quantity. 


Bit Field: A group of up to 32 contiguous bits, 
which spans a maximum of four bytes. 


Bit String: A set of contiguous bits, on the 80386 
bit strings can be up to 4 gigabits long. 


Byte: A signed 8-bit quantity. 

Unsigned Byte: An unsigned 8-bit quantity. 
Integer (Word): A signed 16-bit quantity. 

Long Integer (Double Word): A signed 32-bit quan- 
tity. All operations assume a 2’s complement rep- 


resentation. 


Unsigned Integer (Word): An unsigned 16-bit 
quantity. 


Unsigned Long Integer (Double Word): An un- 
signed 32-bit quantity. 


Signed Quad Word: A signed 64-bit quantity. 
Unsigned Quad Word: An unsigned 64-bit quantity. 


Offset: A 16- or 32-bit offset only quantity which indi- 
rectly references another memory location. 


Pointer: A full pointer which consists of a 16-bit seg- 
ment selector and either a 16- or 32-bit offset. 


Char: A byte representation of an ASCII Alphanu- 
meric or control character. 


String: A contiguous sequence of bytes, words or 
dwords. A string may contain between 1 byte and 
4 Gbytes. 


BCD: A byte (unpacked) representation of decimal 
digits 0-9. 


Packed BCD: A byte (packed) representation of two 
decimal digits 0-9 storing one digit in each nibble. 


When the 80386 is coupled with a numerics Coproces- 
sor such as the 80287 or the 80387 then the following 
common Floating Point types are supported. 


Floating Point: A signed 32-, 64-, or 80-bit real num- 
ber representation. Floating point numbers are sup- 
ported by the 80287 and 80387 numerics coproces- 
sor. 


Figure 2-10 illustrates the data types supported by the 
80386 and the 80387/80287. 
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Figure 2-10. 80386 Supported Data Types 
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2.7 MEMORY ORGANIZATION 


2.7.1 Introduction 


Memory on the 80386 is divided up into 8-bit quanti- 
ties (bytes), 16-bit quantities (words), and 32-bit 
quantities (dwords). Words are stored in two consec- 
utive bytes in memory with the low-order byte at the 
lowest address, the high order byte at the high ad- 
dress. Dwords are stored in four consecutive bytes 
in memory with the low-order byte at the lowest ad- 
dress, the high-order byte at the highest address. 
The address of a word or dword is the byte address 
of the low-order byte. 


In addition to these basic data types the 386 sup- 
ports two larger units of memory: pages and seg- 
ments. Memory can be divided up into one or more 
variable length segments, which can be swapped to 
disk or shared between programs. Memory can also 
be organized into one or more 4K byte pages. Final- 
ly, both segmentation and paging can be combined, 
gaining the advantages of both systems. The 80386 
supports both pages and segment in order to pro- 
vide maximum flexibility to the system designer. 
Segmentation and paging are complementary. Seg- 
mentation is useful for organizing memory in logical 
modules, and as such is a tool for the application 
programmer, while pages are useful for the system 
programmer for managing the physical memory of a 
system. 


2.7.2 Address Spaces 


The 80386 has three distinct address spaces: 
logical, linear, and physical. A logical address 


EFFECTIVE ADDRESS CALCULATION 


ADDRESS 
LOGICAL OR 
14 VIRTUAL ADDRESS 


) 


DESCRIPTOR 
INDEX 
SEGMENT 
REGISTER 


80386 


ADVANCE INFORMATION 


(also known as a virtual address) consists of a se- 
lector and an offset. A selector is the contents of a 
segment register. An offset is formed by summing all 
of the addressing components (BASE, INDEX, DIS- 
PLACEMENT) discussed in section 2.5.3 Memory 
Addressing Modes into an effective address. Since 
each task on 80386 has a maximum of 16K (214 
—1) selectors, and offsets can be 4 gigabytes, (232 
bits) this gives a total of 246 bits or 64 terabytes of 
logical address space per task. The programmer 
sees this virtual address space. 


The segmentation unit translates the logical ad- 
dress space into a 32-bit linear address space. If the 
paging unit is not enabled then the 32-bit linear ad- 
dress corresponds to the physical address. The 
paging unit translates the linear address space into 
the physical address space. The physical address 
is what appears on the address pins. 


The primary difference between Real Mode and Pro- 
tected Mode is how the segmentation unit performs 
the translation of the logical address into the linear 
address. In Real Mode, the segmentation unit shifts 
the selector left four bits and adds the result to the 
offset to form the linear address. While in Protected 
Mode every selector has a linear base address as- 
sociated with it. The linear base address is stored in 
one of two operating system tables (i.e. the Local 
Descriptor Table or Global Descriptor Table). The 
selector’s linear base address is added to the offset 
to form the final linear address. 


Figure 2-11 shows the relationship between the vari- 
ous address spaces. 
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Figure 2-11. Address Translation 
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2.7.3 Segment Register Usage 


The main data structure used to organize memory is 
the segment. On the 386, segments are variable 
sized blocks of linear addresses which have certain 
attributes associated with them. There are three 
main types of segments: code, data, and stack seg- 
ments, the segments are of variable size and can be 
as small as 1 byte or as large as 4 gigabytes (232 
bits). 


In order to provide compact instruction encoding, 
and increase processor performance, instructions 
do not need to explicitly specify which segment reg- 
ister is used. A default segment register is automati- 
cally chosen according to the rules of Table 2-4 
(Segment Register Selection Rules). In general, data 
references use the selector contained in the DS reg- 
ister; Stack references use the SS register and the 
SP register as the offset; and Instruction fetches use 
the CS register. The contents of the Instruction 
Pointer provides the offset. Special segment over- 
ride prefixes allow the explicit use of a given seg- 
ment register, and override the implicit rules listed in 
Table 2-4. The override prefixes also allow the use 
of the FS and GS segment registers. 
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There are no restrictions regarding the overlapping 
of the base addresses of any segments. Thus, all 6 
segments could have the base address set to zero 
and create a system with a four gigabyte linear ad- 
dress space. This creates a system where the virtual 
address space is the same as the linear address 
space. Further details of segmentation are dis- 
cussed in section 4.1. 


2.8 1/0 SPACE 


The 80386 has two distinct physical address 
spaces: Memory and !|/O. Generally, peripherals are 
placed in I/O space although the 80386 also sup- 
ports memory-mapped peripherals. The |/O space 
consists of 64K bytes, it can be divided into 64K 8- 
bit ports, 32K 16-bit ports, or 16K 32-bit ports, or any 
combination of ports which add up to less than 64K 
bytes. The 64K I/O address space refers to physical 
memory rather than linear address since I/O instruc- 
tions do not go through the segmentation or paging 
hardware. The M/IO# pin acts as an additional ad- 
dress line thus allowing the system designer to easi- 
ly determine which address space the processor is 
accessing. 


Table 2-4. Segment Register Selection Rules 


Type of Implied (Default) Segment Override 
Memory Reference Segment Use Prefixes Possible 


Code Fetch 


| cs | Nore 
Destination of PUSH, 
PUSHA instructions 


Source of POP, POPA 
instructions 


Other data references, 
with effective address 
using base register of: 

[EAX] 

[EBX] 

[ECX] 

[EDX] 

[EBX] 

[ESI] 

[EDI]* 

[EBP] 

[ESP] 


CS,SS,ES,FS,GS 
CS,SS,ES,FS,GS 
CS,SS,ES,FS,GS 
CS,SS,ES,FS,GS 
CS,SS,ES,FS,GS 
CS,SS,ES,FS,GS 
CS,SS,ES,FS,GS 
CS,DS,ES,FS,GS 
CS,DS,ES,FS,GS 


* Data references for the memory destination of the STOS and MOVS instructions (and REP STOS and REP MOVS) 
use DI as the base register and ES as the segment, with no override possible. 
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The I/O ports are accessed via the IN and OUT I/O 
instructions, with the port address supplied in the 
DL, DX, or EDX registers. All 8- and 16-bit port ad- 
dresses are zero extended on the upper address 
lines. The I/O instructions cause the M/IO# pin to 
be driven low. 


1/O port addresses OOF8H through OOFFH are re- 
served for use by Intel. The numerics coprocessors 
also reside in this |/O space at locations 800000F8H 
- 800000FCH (see section 5). 


2.9 INTERRUPTS 


2.9.1 Interrupts and Exceptions 


Interrupts and exceptions alter the normal program 
flow, in order to handle external events, to report 
errors or exceptional conditions. The difference be- 
tween interrupts and exceptions is that interrupts are 
used to handle asynchronous external events while 
exceptions handle instruction faults. Although a pro- 
gram can generate a software interrupt via an INT N 
instruction, the processor treats software interrupts 
as exceptions. 


Hardware interrupts occur as the result of an exter- 
nal event and are classified into two types: maskable 
or non-maskable. Interrupts are serviced after the 
execution of the current instruction. After the inter- 
rupt handler is finished servicing the interrupt, exe- 
cution proceeds with the instruction immediately 
after the interrupted instruction. Sections 2.9.3 and 
2.9.4 discuss the differences between Maskable and 
Non-Maskable interrupts. 


Exceptions are classified as faults, traps, or aborts 
depending on the way they are reported, and wheth- 
er or not restart of the instruction causing the excep- 
tion is supported. Faults are exceptions that are de- 
tected and serviced before the execution of the 
faulting instruction. A fault would occur in a virtual 
memory system, when the processor referenced a 
page or a segment which was not present. The oper- 
ating system would fetch the page or segment from 
disk, and then the 80386 would restart the instruc- 
tion. Traps are exceptions that are reported immedi- 
ately after the execution of the instruction which 
caused the problem. User defined interrupts are ex- 
amples of traps. Aborts are exceptions which do 
not permit the precise location of the instruction 
causing the exception to be determined. Aborts are 
used to report severe errors, such as a hardware 
error, or illegal values in system tables. 
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Thus, when an interrupt service routine has been 
completed, execution proceeds from the instruction 
immediately following the interrupted instruction. On 
the other hand, the return address from an excep- 
tion fault routine will always point at the instruction 
causing the exception and include any leading in- 
struction prefixes. Table 2-5 summarizes the possi- 
ble interrupts for the 80386 and shows where the 
return address points to. 


The 80386 has the ability to handle up to 256 differ- 
ent interrupts/exceptions. In order to service the in- 
terrupts, a table with up to 256 interrupt vectors 
must be defined. The interrupt vectors are simply 
pointers to the appropriate interrupt service routine. 
In Real Mode (see section 3.1), the vectors are 4 
byte quantities, a Code Segment plus a 16-bit offset; 
in Protected Mode, the interrupt vectors are 8 byte 
quantities, which are put in an Interrupt Descriptor 
Table (see section 4.1). Of the 256 possible inter- 
rupts, 32 are reserved for use by Intel, the remaining 
224 are free to be used by the system designer. 


2.9.2 Interrupt Processing 


When an interrupt occurs the following actions hap- 
pen. First, the current program address and the 
Flags are saved on the stack to allow resumption of 
the interrupted program. Next, an 8-bit vector is sup- 
plied to the 80386 which identifies the appropriate 
entry in the interrupt table. The table contains the 
starting address of the interrupt service routine. 
Then, the user supplied interrupt service routine is 
executed. Finally, when an IRET instruction is exe- 
cuted the old processor state is restored and pro- 
gram execution resumes at the appropriate instruc- 
tion. 


The 8-bit interrupt vector is supplied to the 80386 in 
several different ways: exceptions supply the inter- 
rupt vector internally; software INT instructions con- 
tain or imply the vector; maskable hardware inter- 
rupts supply the 8-bit vector via the interrupt ac- 
knowledge bus sequence. Non-Maskable hardware 
interrupts are assigned to interrupt vector 2. 


2.9.3  Maskable Interrupt 


Maskable interrupts are the most common way used 
by the 80386 to respond to asynchronous external 
hardware events. A hardware interrupt occurs when 
the INTR is pulled high and the Interrupt Flag bit (IF) 
is enabled. The processor only responds to inter- 
rupts between instructions, (REPeat String instruc- 
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Table 2-5. Interrupt Vector Assignments 


Return Address 
Interrupt Instruction Which Points to 
Can Cause Type 
Number Faulting 
Exception 
Instruction 


__NMI_| 


ABORT 
TRAP** 


Divide Error 


fowowSSC~dCY 
re 
Ss | ad 


Debug Exception 


One Byte Interrupt 
Interrupt on Overflow 
Array Bounds Check 
Invalid OP-Code 


| oo ES 
= ES 
=m 

at 

| 6 | Anylilegal instruction | YES 
Device Not Available YES 
Generate an Exception 

Overrun Past the End of a Segment 

Segment Not Present | 11 | Segment Register instructions _| ES 

Stack Fault ES 
General Protection Fault | 13 | AnyMemoryReference | YES 
FCoprocessorEor | 16 | ESGWAT | VES ~~ ‘FAULT 
FinteiResoned | w-a2 | SSCSC~iSC“‘C‘;SC*rC*d’ 
[TwoByteinterupt | 0-265 |inTh =| NO TRAP 


* Some debug exceptions may report both traps on the previous instruction, and faults on the next instruction. 
** Exception 9 no longer occurs on the 80386 due to the improved interface between the 80386 and its coprocessors. 


Y' 
Y 
Y 


tions, have an “interrupt window”, between memory 2.9.4 Non-Maskable Interrupt 
moves, which allows interrupts during long string 


moves). When an interrupt occurs the processor Non-maskable interrupts provide a method of servic- 


reads an 8-bit vector supplied by the hardware which ing very high priority interrupts. A common example 
identifies the source of the interrupt, (one of 224 of the use of a non-maskable interrupt (NMI) would 
user defined interrupts). The exact nature of the in- be to activate a power failure routine. When the NMI 
terrupt sequence is discussed in section 5. input is pulled high it causes an interrupt with an 


internally supplied vector value of 2. Unlike a normal 
The IF bit in the EFLAG registers is reset when an hardware interrupt, no interrupt acknowledgment se- 
interrupt is being serviced. This effectively disables quence is performed for an NMI. 
servicing additional interrupts during an interrupt 


service routine. However, the IF may be set explicitly While executing the NMI servicing procedure, the 


by the interrupt handler, to allow the nesting of inter- 80386 will service neither further NMI request, nor 
rupts. When an IRET instruction is executed the INT requests, until an interrupt return (IRET) instruc- 
original state of the IF is restored. tion is executed or the processor is reset. If NMI 


occurs while currently servicing an NMI, its presence 
will be saved for servicing after executing the first 
IRET instruction. The IF bit is cleared at the begin- 
ning of an NMI interrupt to inhibit further INTR inter- 
rupts. 
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2.9.5 Software Interrupts 


A third type of interrupt/exception for the 80386 is 
the software interrupt. An INT n instruction causes 
the processor to execute the interrupt service rou- 
tine pointed to by the nth vector in the interrupt ta- 
ble. 


A special case of the two byte software interrupt INT 
nis the one byte INT 3, or breakpoint interrupt. By 
inserting this one byte instruction in a program, the 
user can set breakpoints in his program as a debug- 
ging tool. 


A final type of software interrupt, is the single step 
interrupt. It is discussed in section 2.12. 


2.9.6 Interrupt Priorities 


Since interrupts are recognized only at instruction 
boundaries it is possible for more than one interrupt 
to be active at the same time. If there are simulta- 
neous interrupts they will be processed according to 
the priority shown in Table 2-6. Example: A given 
instruction causes both a debug trap and a segment 
not-present exception. The 80386 will first respond 
to the segment not-present exception (11) by at- 
tempting to invoke the exception 11 handler. The 
exception 11 handler will be interrupted causing the 
address of the exception 11 handler to be pushed 
on the stack. The debug exception handler (1) will 
then be called. After the debug handler is finished, 
control will pass back to the exception 11 handler. 
This allows the system designer to debug his excep- 
tion handlers. 


Table 2-6. Interrupt Processing Priorities 


Processing 
Priority 


1 (highest) 


Interrupt/Exception 


Exception faults 
TRAP instructions 


Debug Traps for this instruction 
Debug Faults for next instruction 
NMI interrupt 

INTR interrupt 


2.9.7 Instruction Restart 


The 80386 fully supports restarting all instructions 
after faults. The operating system does not need to 
Participate in the restart process, since the proces- 
sor will report a page or segment fault with the ma- 
chine in a state that permits restarting of the faulting 
instruction after the fault handler has corrected the 
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faulting condition. (e.g. a page fault was generated, 
the page fault handler brings in the correct page). 


Instruction restart is guaranteed except for two con- 
ditions: If the instruction causes a task switch to a 
TSS that is located in a not-present page. If one of 
the operands is located below any of the current 
stack pointers (i.e. at a memory address less than 
the top of stack) or if a floating point operand wraps 
around in memory. 


2.9.8 Double Faults 


A double fault results when the processor is at- 
tempting to handle an exception, and receives an- 
other exception during the handling routine. A dou- 
ble fault causes an exception 8. Most exceptions on 
the 80386 do not count toward the double fault con- 
dition (types 1, 2, 3, 4, 5, 6, 7, 9, 14, and 16). Only 
zero-divide errors (interrupt 0) and the segment ex- 
ceptions (10, 11, 12, 13) count toward a double fault. 
Therefore receiving segment not-present exception 
(11) while responding to a debug exception would 
not result in a double fault. While a segment fault 
which occurred during a zero-divide handler would 
cause a double fault. 


Page faults do not count toward double faults. For 
instance, if an instruction caused both a segment 
not-present exception (11) and a page not-present 
fault (interrupt 14) both interrupts would be proc- 
essed correctly. The segment not-present handler 
would be invoked causing the correct segment to be 
loaded from the disk. The instruction would be re- 
started, and would then cause a page fault. The 
page fault handler would then bring in the correct 
page, and execution would proceed. This supports 
the concept of paging being ‘‘underneath” segmen- 
tation. 


A final cause of double faults is recursive faults (e.g. 
the page fault handler is not present). These cause 
an exception 8. 


2.10 RESET AND INITIALIZATION 


When the processor is initialized or Reset the regis- 
ters have the values shown in Table 2-7. The 80386 
will then start executing instructions near the top of 
physical memory, at location FFFFFFFOH. When the 
first InterSegment Jump or Call is executed, address 
lines A20-31 will drop low, and the 80386 will only 
execute instructions in the lower one megabyte of 
physical memory. This allows the system designer to 
use a ROM at the top of physical memory to initialize 
the system and take care of Resets. 
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Driving the RESET input pin HIGH for at least 78 
CLK2 periods Resets the 80386. RESET forces the 
80386 to terminate all execution and local bus activi- 
ty. No instruction execution or bus activity will occur 
as long as Reset is active. Between 350 and 450 
CLK2 periods after Reset becomes inactive the 
80386 will start executing instructions at the top of 
physical memory. 


Table 2-7. Register Values after Reset 


Flag Word UUUU0002H Note 1 
Machine Status Word (CRO)}| UUUUUUU0H Note 2 
Instruction Pointer OOOOFFFOH 
Code Segment FOOOH 
Data Segment 0000H 
0000H 
0000H 
0000H 
0000H 
undefined 


Note 3 


Stack Segment 
Extra Segment (ES) 
Extra Segment (FS) 
Extra Segment (GS) 
All other registers 


NOTES: 

1. EFLAG Register. The upper 14 bits of the EFLAGS reg- 
ister are undefined, VM (Bit 17) and RF (BIT) 16 are 0 as 
are all other defined flag bits. 

2. CRO: (Machine Status Word). All of the defined fields in 
the CRO are 0 (PG Bit 31, TS Bit 3, EM Bit 2, MP Bit 1, and 
PE Bit 0) except for ET Bit 4 (processor extension type). 
The ET Bit is set during Reset according to the type of Co- 
processor in the system. If the coprocessor is an 80387 
then ET will be 1, if the coprocessor is an 80287 or no 
coprocessor is present then ET will be 0. All other bits are 
undefined. 

3. The Code Segment Register (CS) will have its Base Ad- 
dress set to FFFOOOOOH and Limit set to OFFFFH. All un- 
defined bits are Intel Reserved and should not be used. 


2.11 TESTABILITY 


2.11.1 Self-Test 


The 80386 has the capability to perform a self-test. 
The self-test checks the function of all of the Control 
ROM and most of the non-random logic of the part. 
Approximately one-half of the 80386 can be tested 
during self-test. 
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Self-Test is initiated on the 80386 when the RESET 
pin transitions from HIGH to LOW, and the BUSY # 
pin is low. The self-test takes about 2**19 CLK2s, or 
approximately 30 milliseconds with a 16 MHz 80386. 
At the completion of self-test the processor per- 
forms reset and begins normal operation. The part 
has successfully passed self-test if the contents of 
the EAX and the EDX register are zero (0). If the 
results of EAX and EDX are not zero then the self- 
test has detected a flaw in the part. 


2.11.2 TLB Testing 


The 80386 also provides a mechanism for testing 
the Translation Lookaside Buffer (TLB) (see section 
4.5.4 Translation Lookaside Buffer). This feature 
is primarily useful for people who wish to write test 
programs for the 80386. The TLB testing method is 
unique to the 80386 and may not be continued in 
future microprocessors. Testing the TLB requires 
the use of a tester or an assembly language pro- 
gram to drive a test pattern. Paging must be disabled 
in order to test the functionality of the TLB. 


Two test registers provide a means of writing a pat- 
tern into the TLB and reading the result. TR6 is the 
test command register, and TR7 is the test data reg- 
ister. Figure 2-12 shows the two test registers. 


The test registers allow two operations to be per- 
formed on the TLB: Write New TLB Entry, Perform 
TLB Lookup. A write to the test command register 
via the MOV TR6, REG instructions causes a TLB 
operation to be performed. If bit 0 of TR6 is a 0, a 
Write New TLB Entry operation occurs if bit 0 is 1 
then a TLB Lookup is performed. 


2.12 DEBUGGING SUPPORT 


The 80386 provides several features which simplify 
the debugging process. Most of these features are 
designed primarily for software debugging. (Note: In- 
tel will provide a complete set of Hardware/Software 
debugging tools such as ICE-386 (In Circuit Emula- 
tor) and PTM-386 (Pass Through Monitor) to com- 
plement the built in debugging features.) 


NOTE: [0] indicates Intel reserved: Do not define; SEE SECTION 2.3.10 


Figure 2-12. Test Registers 
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The three major types of on-chip debugging aids are 
the software breakpoints, single stepping and the 
debug registers. A one byte interrupt INT 3 is avail- 
able for use by software debuggers to implement 
breakpoints. The debugger should insert the INT 3 
instructions in code sequences. When the INT 3 in- 
struction is encountered execution will proceed at 
the interrupt handler 3. 


The single step interrupt is enabled by setting the 
single step bit (TF) in the flag word. The TF bit is set 
by altering the stack image and executing a POPF or 
IRET instruction. After the TF bit is set, a single step 
interrupt will occur after the next instruction is exe- 
cuted. The interrupted instruction will push the cur- 
rent Flag register on the stack (with the TF bit set) 
and then will clear the TF bit, (enabling the single 
step interrupt handling routine to execute normally). 
This allows an interrupt handler to be created which 
can single step through a sequence of instructions. 
The single step interrupt uses interrupt vector 1, 
which is supplied internally to the processor. 


After completion of the single step interrupt handling 
routine, the IRET will pop the flag register and then 
transfer control to the next instruction to be single 
stepped. 


Debug Registers are a unique feature of the 80386. 
The six program accessible debug registers provide 
the ability to specify up to four distinct breakpoints. 
Unlike traditional breakpoints which only support in- 
struction breakpointing, the 80386 debug registers 
allow breakpoints to be set for data accesses. Thus, 
if a variable is accidently being overwritten, a break- 
point can be setup to stop execution whenever that 
variable’s contents are being changed. 
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Figure 2-13 shows the Debug Registers in more de- 
tail. DRO--3 contains the linear address of the break- 
point. 


NOTE: 
The linear address may not correspond to the 
physical address if paging is enable. 


DR6 contains the status of the breakpoint registers. 
The bits within the register have the following mean- 
ings: 


BT is set if a task switch occurs into a task where 
the TSS has the DEBUG TRAP bit set. 


BS: Enables the debug handlers to distinguish sin- 
gle-step traps from the other debug conditions. 


BD: Is set by the hardware if the next instruction 
accesses a debug register. 


BO-B3: These bits are set if a qualified breakpoint 
has occurred. BO is set if the Breakpoint 0 has 
happened etc. 


DR7 is the Debug Control Register it is used to 
enable and qualify the various breakpoints: The 
bits assignment are assigned as follows: 


LENi : This is a two bit field which specifies the 
length of the breakpoint i . All breakpoints must be 
aligned; 2 byte breakpoints must be aligned on 
Word boundaries, and 4 byte breakpoints must be 
aligned on Dword boundaries. 


00 = byte length 
01 = byte length 
10 = UNDEFINED 
11 = 4 byte length 


0 


BREAKPOINT 0 LINEAR ADDRESS 


BREAKPOINT 1 LINEAR ADDRESS 
BREAKPOINT 2 LINEAR ADDRESS 


BREAKPOINT 3 LINEAR ADDRESS 
Intel reserved. Do not define. 


Intgl reserved. Do not define. 


= B - 

j 3 T ‘ 

LEN LEN LEN |R|W| LEN ‘ole ololo LI|G|LIG/LIG}LIG}L 
3 2 1 he eae nt Ela | E|3}3]2/211|/1]/0]0 

31 0 


16 15 
a indicates Intel reserved: Do not define; SEE SECTION 2.3.10 


Figure 2-13. Debug Registers 
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RWEi: This two-bit field specifies the type of mem- 
ory access which must occur in order to activate a 
breakpoint: 


"AWE Breakon | 


Instruction Execution only 
Data Writes Only 


UNDEFINED 
Data Reads or Writes only 
(not Instruction fetches) 


GE/LE Global and Local Exact breakpoints: 
These bits should always be set to 1 when using 
breakpoints. 


Gi/Li Global and Local breakpoint enables. If ei- 
ther Gi 1 or Li 1, then breakpoint i is en- 
abled. If these bits are set then any qualified 
breakpoint (i.e. a breakpoint which matches the 
condition specified by the LWE bits) will cause the 
processor to execute the debug handler. The Li 
bits allows local breakpoints to be set for an indi- 
vidual task but will not affect another task. The Gi 
bits allow global breakpoints to be set which affect 
all tasks. 


In order to set a breakpoint the processor must be 
executing at privilege level 0, or in Real Mode. Then, 
the breakpoint must be set by loading the breakpoint 
register (via a MOV DRi, REG/MEM instruction), 
with the address of the breakpoint. Then, the appro- 
priate LEN and RWE must be set up. Finally, the 
breakpoint enable bits must be set Gi and/or Li. 


SEGMENT 
SELECTOR { cand 
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NOTE: 
The Bi bits in DR6 will always show any qualified 
breakpoints, but unless Gi or Li are set the proces- 
sor will not execute the debug routine at interrupt 1. 


3. REAL MODE ARCHITECTURE 


3.1 REAL MODE INTRODUCTION 


When the processor is reset or powered up it is ini- 
tialized in Real Mode. Real Mode has the same base 
architecture as the 8086, but allows access to the 
32-bit register set of the 80386. The addressing 
mechanism, memory size, interrupt handling, are all 
identical to the Real Mode on the 80286. 


All of the 80386 instructions are available in Real 
Mode. The default operand size in Real Mode is 16- 
bits, just like the 8086. In order to use the 32-bit 
registers and addressing modes, override prefixes 
must be used. In addition, the segment size on the 
80386 in Real Mode is 64K bytes so 32-bit address- 
es must have a value less the OOOOFFFFH. The pri- 
mary purpose of Real Mode is to set up the proces- 
sor for Protected Mode Operation. 


3.2 MEMORY ADDRESSING 


In Real Mode the maximum memory size is limited to 
1 megabyte. Thus, only address lines A2-A19, 
BEO-B3 are active. (Exception, the high address 
lines A20-A31 are high until an intersegment jump 
or call is executed (see section 2.10)). 


MAX LIMIT 
FIXED AT 
REAL MODE 


MEMORY OPERAND 


SELECTED 
SEGMENT 


SEGMENT BASE 


Figure 3-1. Real Address Mode Addressing 
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Since, paging is not allowed in Real Mode the linear 
addresses are the same as physical addresses. 
Physical addresses are formed in Real Mode by 
adding the contents of the appropriate segment reg- 
ister which is shifted left by four bits to an effective 
address. This addition results in a 20-bit physical ad- 
dress or a 1 megabyte address space. Since seg- 
ment registers are shifted left by 4 bits this implies 
that Real Mode segments always start on 16 byte 
boundaries. 


All segments in Real Mode are exactly 64K bytes 
long, and may be read, written, or executed. The 
80386 will generate an exception 13 if a data oper- 
and or instruction fetch occurs past the end of a 
segment. (i.e. if an operand has an offset greater the 
FFFFH, example a word with a low byte at FFFFH 
and the high byte at 0000H) 


Segments may be overlapped in Real Mode. Thus, if 
a particular segment does not use all 64K bytes an- 
other segment can be overlayed on top of the un- 
used portion of the previous segment. This allows 
the programmer to minimize the amount of physical 
memory needed for a program. 


3.3 RESERVED LOCATIONS 


There are two fixed areas in memory which are re- 
served in Real address mode: system initialization 
area and the interrupt table area. Locations O0000H 
through OO03FFH are reserved for interrupt vectors. 
Each one of the 256 possible interrupts has a 4-byte 
jump vector reserved for it. Locations FFFFFFFOH 
through FFFFFFFFH are reserved for system initiali- 
zation. 


3.4 INTERRUPTS 


Many of the exceptions shown in Table 2-5 and dis- 
cussed in section 2.9 are not applicable to Real 
Mode operation, in particular exceptions 10, 11, 12, 
14, will not happen in Real Mode. Other exceptions 
have slightly different meanings in Real Mode Table 
3-1 identifies these exceptions. 


3.5 SHUTDOWN AND HALT 


The HLT instruction stops program execution and 
prevents the processor from using the local bus until 
restarted. Either NMI, INTR with interrupts enabled 
(IF =1), or RESET will force the 80386 out of halt. If 
interrupted, the saved CS:IP will point to the next 
instruction after the HLT. 


Shutdown will occur when a severe error is detected 
that prevents further processing. In Real Mode, 
shutdown can occur under two conditions: 


An interrupt or an exception occur (Exceptions 8 
or 13) and the interrupt vector is larger than the 
Interrupt Descriptor Table (i.e. There is not an in- 
terrupt handler for the interrupt). 


A CALL, INT or PUSH instruction attempts to wrap 
around the stack segment when SP is not even. 
(e.g. pushing a value on the stack when SP = 
0001 resulting a stack segment greater than 
FFFFH) 


An NMI input can bring the processor out of shut- 
down if the Interrupt Descriptor Table limit is large 
enough to contain the NMI interrupt vector (at least 
OOOFH) and the stack has enough room to contain 
the vector and flag information (i.e. SP is greater 
than 0005H). Otherwise shutdown can only be exit- 
ed via the RESET input. 


Table 3-1 
Interrupt Related Return 
Number Instructions Address Location 
Interrupt table limit too small INT Vector is not Before 
within table limit Instruction 


Segment overrun exception Word memory reference Before 
With offset = FFFFH or Inst. Instruction 
an attempt to execute 
past the end of a segment 
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4. PROTECTED MODE 
ARCHITECTURE 


4.1 INTRODUCTION 


The complete capabilities of the 80386 are unlocked 
when the processor operates in Protected Virtual 
Address Mode (Protected Mode). Protected Mode 
vastly increases the linear address space to four gig- 
abytes (232 bytes) and allows the running of virtual 
memory programs of almost unlimited size (64 tera- 
bytes or 246 bytes). In addition Protected Mode al- 
lows the 80386 to run all of the existing 8086 and 
80286 software, while providing a sophisticated 
memory management and a hardware-assisted pro- 
tection mechanism. Protected Mode allows the use 
of additional instructions especially optimized for 
supporting multitasking operating systems. The base 
architecture of the 80386 remains the same, the reg- 
isters, instructions, and addressing modes described 
in the previous sections are retained. The main dif- 
ference between Protected Mode, and Real Mode 
from a programmer’s view is the increased address 
space, and a different addressing mechanism. 
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4.2 ADDRESSING MECHANISM 


Like Real Mode, Protected Mode uses two compo- 
nents to form the logical address, a 16-bit selector is 
used to determine the linear base address of a seg- 
ment, the base address is added to a 32-bit effective 
address to form a 32-bit linear address. The linear 
address is then either used as the 32-bit physical 
address, or if paging is enabled the paging mecha- 
nism maps the 32-bit linear address into a 32-bit 
physical address. 


The difference between the two modes lies in calcu- 
lating the base address. In Protected Mode the se- 
lector is used to specify an index into an operating 
system defined table (see Figure 4-1). The table 
contains the 32-bit base address of a given seg- 
ment. The physical address is formed by adding the 
base address obtained from the table to the offset. 


Paging provides an additional memory management 
mechanism which operates only in Protected Mode. 
Paging provides a means of managing the very large 
segments of the 80386, as such paging operates 
beneath segmentation. The paging mechanism 
translates the protected linear address which comes 
from the segmentation unit into a physical address. 
Figure’ 4-2 shows the complete 80386 addressing 
mechanism with paging enabled. 
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Figure 4-1. Protected Mode Addressing 
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Figure 4-2. Paging and Segmentation 


4.3 SEGMENTATION 


4.3.1 Segmentation Introduction 


Segmentation is one method of memory manage- 
ment. Segmentation provides the basis for protec- 
tion. Segments are used to encapsulate regions of 
memory which have common attributes. For exam- 
ple, all of the code of a given program could be con- 
tained in a segment, or an operating system table 
may reside in a segment. All information about the 
segments, is stored in an 8 byte data structure 
called a descriptor. All of the descriptors in a system 
are contained in tables recognized by hardware. 


4.3.2 Terminology 


The following terms are used throughout the discus- 
sion of descriptors, privilege levels and protection: 


PL: Privilege Level—One of the four hierarchical 
privilege levels. Level 0 is the most privileged level 
and level 3 is the least privileged. More privileged 
levels are numerically greater than less privileged 
levels. 
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RPL: Requestor Privilege Level—The privilege level 
of the original supplier of the selector. RPL is deter- 
mined by the least two significant bits of a selector. 


DPL: Descriptor Privilege Level—This is the least 
privileged level at which a task may access that de- 
scriptor (and the segment associated with that de- 
scriptor). Descriptor Privilege Level is determined by 
bits 6:5 in the Access Right Byte of a descriptor. 


CPL: Current Privilege Level—The privilege level at 
which a task is currently executing, which equals the 
privilege level of the code segment being executed. 
CPL can also be determined by examining the low- 
est 2 bits of the CS register, except for conforming 
code segments. 


EPL: Effective Privilege Level—The effective privi- 
lege level is the least privileged of the RPL and DPL. 
Since smaller privilege level values indicate greater 
privilege, EPL is the numerical maximum of RPL and 
DPL. 


Task: One instance of the execution of a program. 
Tasks are also refered to as processes. 
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4.3.3 Descriptor Tables 


4.3.3.1 DESCRIPTOR TABLES INTRODUCTION 


The descriptor tables define all of the segments 
which are used in an 80386 system. There are three 
types of tables on the 80386 which hold descriptors: 
the Global Descriptor Table, Local Descriptor Table, 
and the Interrupt Descriptor Table. All of the tables 
are variable length memory arrays, they can range in 
size between 8 bytes and 64K bytes. Each table can 
hold up to 8192 8 byte descriptors. The upper 13 
bits of a selector are used as an index into the de- 
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scriptor table. The tables have registers associated 
with them which hold the 32-bit linear base address, 
and the 16-bit limit or each table. 


Each of the tables has a register associated with it 
the GDTR, LDTR, and the IDTR; see Figure 4-3. The 
LGDT, LLDT, and LIDT instructions, load the base 
and limit of the Global, Local, and Interrupt Descrip- 
tor Tables, into the appropriate register. The SGDT, 
SLDT, and SIDT store the base and limit values. 
These tables are manipulated by the operating sys- 
tem. Therefore, the load descriptor table instructions 
are privileged instructions. 


# PROGRAM INVISIBLE 
‘ AUTOMATICALLY LOADED 
« FROM LOT DESCRIPTOR 


Figure 4-3. Descriptor Table Registers 
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4.3.3.2 GLOBAL DESCRIPTOR TABLE 


The Global Descriptor Table (GDT) contains de- 
scriptors which are possibly available to all of the 
tasks in a system. The GDT can contain any type of 
segment descriptor except for descriptors which are 
used for servicing interrupts (i.e. interrupt and trap 
descriptors). Every 386 system contains a GDT. 
Generally the GDT contains code and data seg- 
ments used by the operating systems and task state 
segments, and descriptors for the LDTs in a system. 


The first slot of the Global Descriptor Table corre- 
sponds to the null selector and is not used. The null 
selector defines a null pointer value. 


4.3.3.3 LOCAL DESCRIPTOR TABLE 


LDTs contain descriptors which are associated with 
a given task. Generally, operating systems are de- 
signed so that each task has a separate LDT. The 
LDT may contain only code, data, stack, task gate, 
and call gate descriptors. LDTs provide a mecha- 
nism for isolating a given task’s code and data seg- 
ments from the rest of the operating system, while 
the GDT contains descriptors for segments which 
are common to all tasks. A segment cannot be ac- 
cessed by a task if its segment descriptor does not 
exist in either the current LDT or the GDT. This pro- 
vides both isolation and protection for a task’s seg- 
ments, while still allowing global data to be shared 
among tasks. 


Unlike the 6 byte GDT or IDT registers which contain 
a base address and limit, the visible portion of the 
LDT register contains only a 16-bit selector. This se- 
lector refers to a Local Descriptor Table descriptor in 
the GDT. 


SEGMENT BASE 15. 


Base Address of the segment 

The length of the segment 

Present Bit 1=Present O=Not Present 
Descriptor Privilege Level 0-3 


80386 


ADVANCE INFORMATION 


4.3.3.4 INTERRUPT DESCRIPTOR TABLE 


The third table needed for 80386 systems is the In- 
terrupt Descriptor Table. (See Figure 4-4.) The IDT 
contains the descriptors which point to the location 
of up to 256 interrupt service routines. The IDT may 
contain only task gates, interrupt gates, and trap 
gates. The IDT should be at least 256 bytes in size in 
order to hold the descriptors for the 32 Intel Re- 
served Interrupts. Every interrupt used by a system 
must have an entry in the IDT. The IDT entries are 
referenced via INT instructions, external interrupt 
vectors, and exceptions. (See 2.9 Interrupts). 
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Figure 4-4. Interrupt Descriptor 
Table Register Use 


4.3.4 Descriptors 


4.3.4.1 DESCRIPTOR ATTRIBUTE BITS 


The object to which the segment selector points to 
is called a descriptor. Descriptors are eight byte 
quantities which contain attributes about a given re- 
gion of linear address space (i.e. a segment). These 


BYTE 
ADDRESS 


0 


SEGMENT LIMIT 15. 


Segment Descriptor O=System Descriptor 1=Code or Data Segment Descriptor 


Type of Segment 
Accessed Bit 
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Default Operation Size (recognized in code segment descriptors only) 
Bit must be zero (0) for compatibility with future processors 


1=32-bit segment 0O= 16-bit segment 


Figure 4-5. Segment Descriptors 
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attributes include the 32-bit base linear address of 
the segment, the 20-bit length and granularity of the 
segment, the protection level, read, write or execute 
privileges, the default size of the operands (16-bit or 
32-bit), and the type of segment. All of the attribute 
information about a segment is contained in 12 bits 
in the segment descriptor. Figure 4-5 shows the gen- 
eral format of a descriptor. All segments on the 
80386 have three attribute fields in common: the P 
bit, the DPL bit, and the S bit. The Present P bit is 1 
if the segment is loaded in physical memory, if P=0 
then any attempt to access this segment causes a 
not present exception (exception 11). The Descrip- 
tor Privilege Level DPL is a two-bit field which speci- 
fies the protection level 0-3 associated with a seg- 
ment. 


SEGMENT BASE 15...0 


LIMIT 
BASE 31... 24 je}o]o] 19...16 


D/B_ 1=Default Instructions Attributes are 32-Bits 
0= Default Instruction Attributes are 16-Bits 
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The 80386 has two main categories of segments 
system segments and non-system segments (for 
code and data). The segment S bit in the segment 
descriptor determines if a given segment is a system 
segment or a code or data segment. If the S bit is 1 
then the segment is either a code or data segment, if 
it is 0 then the segment is a system segment. 


4.3.4.2 386 CODE, DATA DESCRIPTORS (S=0) 
Figure 4-6 shows the general format of a code and 


data descriptor and Table 4-1 illustrates how the bits 
in Access Right Byte are interpreted. 


ACCESS 


RIGHTS 
BYTE 


G Granularity Bit 1=Segment length is page granular 
0= Segment length is byte granular 
Bit must be zero (0) for compatibility with future processors 


Figure 4-6. Segment Descriptors 


Table 4-1. Access Rights Byte Definition for Code and Data Descriptions 


Segment is mapped into physical memory. 
No mapping to physical memory exits, base and limit are 
not used. 


Descriptor Privilege 
Level (DPL) 
Segment Descrip- 


Segment privilege attribute used in privilege tests. 


Code or Data (includes stacks) segment descriptor 


System Segment Descriptor or Gate Descriptor 


Executable (E) 
Expansion Direc- 


Data segment descriptor type is: 
0 Expand up segment, offsets must be < limit. 
= 1 Expand down segment, offsets must be > limit. 
Data segment may not be written into. 
Data segment may be written into. 


Segment 
(S = 1, 
E = 0) 


Code segment descriptor type is: 


Code segment may only be executed 
when CPL = DPL and CPL 

remains unchanged. 

Code segment may not be read. 


Readable (R) 


Code 
Segment 
(S=1, 
E = 1) 


Code segment may be read. 


Accessed (A) 


Segment has not been accessed. 


Segment selector has been loaded into segment register 
or used by selector test instructions. 
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Code and data segments have several descriptor 
fields in common. The accessed A bit is set whenev- 
er the processor accesses a descriptor. The A bit is 
used by operating systems to keep usage statistics 
on a given segment. The G bit, or granularity bit, 
specifies if a segment length is byte-granular or 
page-granular. 80386 segments can be one mega- 
byte long with byte granularity (G=0) or four giga- 
bytes with page granularity (G=1), (i.e. 220 pages 
each page is 4K bytes in length). The granularity is 
totally unrelated to paging. A 80386 system can con- 
sist of segments with byte granularity, and page 
granularity, whether or not paging is enabled. 


The executable E bit tells if a segment is a code or 
data segment. A code segment (E= 1, S= 1) may be 
execute-only or execute/read as determined by the 
Read R bit. Code segments are execute only if 
R=0, and execute/read if R=1. Code segments 
may never be written into. 


NOTE: 
Code segments may be modified via aliases. Alias- 
es are writeable data segments which occupy the 
same range of linear address space as the code 
segment. 


The D bit indicates the default length for operands 
and effective addresses. If D=1 then 32-bit oper- 
ands and 32-bit addressing modes are assumed. If 
D=0 then 16-bit operands and 16-bit addressing 
modes are assumed. Therefore all existing 286 code 
segments will execute on the 80386 assuming the D 
bit is set 0. 


Another attribute of code segments is determined by 
the conforming C bit. Conforming segments, C= 1, 
can be executed and shared by programs at differ- 
ent privilege levels. (See section 4.4 Protection.) 
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Segments identified as data segments (E=0, S= 1) 
are used for two types of 80386 segments: stack 
and data segments. The expansion direction (ED) bit 
specifies if a segment expands downward (stack) or 
upward (data). If a segment is a stack segment all 
offsets must be greater than the segment limit. On a 
data segment all offsets must be less than or equal 
to the limit. In other words, stack segments start at 
the base linear address plus the maximum segment 
limit and grow down to the base linear address plus 
the limit. On the other hand, data segments start at 
the base linear address and expand to the base lin- 
ear address plus limit. 


The write W bit controls the ability to write into a 
segment. Data segments are read-only if W=0. The 
stack segment must have W= 1. 


The B bit controls the size of the stack pointer regis- 
ter. lf B=1 PUSHes, POPs, and CALLs all use the 
32-bit ESP register for stack references and assume 
an upper limit of FFFFFFFFH. If B=0 stack instruc- 
tions all use the 16-bit SP register and assume an 
upper limit of FFFFH. 


4.3.4.3 SYSTEM DESCRIPTOR FORMATS 


System segments describe information about oper- 
ating system tables, tasks, and gates. Figure 4-7 
shows the general format of system segment de- 
scriptors, and the various types of system segments. 
80386 system descriptors contain a 32-bit base lin- 
ear address and a 20-bit segment limit. 80286 sys- 
tem descriptors have a 24-bit base address and a 
16-bit segment limit. 80286 system descriptors are 
identified by the upper 16 bits being all zero. 


31 16 0 
SEGMENT BASE 15. SEGMENT LIMIT 15. 


SoS DODO SS CSP 


Defines 


Invalid 

Available 286 TSS 
LDT 

Busy 286 TSS 
286 Call Gate 

286 Task Gate 
286 Interrupt Gate 
286 Trap Gate 


— 
1 
2 
3 
4 
5 
6 
7 


Defines 


Invalid 

Available 386 TSS 
Undefined (Intel Reserved) 
Busy 386 TSS 

386 Call Gate 

Undefined (Intel Reserved) 
386 Interrupt Gate 

386 Trap Gate 


Figure 4-7. System Segments Descriptors 
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4.3.4.4 LDT DESCRIPTORS (S=0, TYPE = 2) 


LDT descriptors (S=0 TYPE=2) contain informa- 
tion about Local Descriptor Tables. LDTs contain a 
table of segment descriptors, unique to a particular 
task. Since the instruction to load the LDTR is only 
available at privilege level 0, the DPL field is ignored. 
LDT descriptors are only allowed in the Global De- 
scriptor Table (GDT). 


4.3.4.5 TSS DESCRIPTORS (S=0, 
TYPE = 1, 3, 9, B) 


A Task State Segment (TSS) descriptor contains in- 
formation about the location, size, and privilege level 
of a Task State Segment (TSS). A TSS in turn is a 
special fixed format segment which contains all the 
state information for a task and a linkage field to 
permit nesting tasks. The TYPE field is used to indi- 
cate whether the task is currently BUSY (i.e. on a 
chain of active tasks) or the TSS is available. The 
TYPE field also indicates if the segment contains a 
286 or a 386 TSS. The Task Register (TR) contains 
the selector which points to the current Task State 
Segment. 


4.3.4.6 GATE DESCRIPTORS (S=0, 
TYPE =4-7, C, F) 


Gates are used to control access to entry points 
within the target code segment. The various types of 


Gate Descriptor Fields 


< 
J 
c 
® 


286 call gate 
Task gate 

286 interrupt gate 
286 trap gate 
386 call gate 

386 interrupt gate 
386 trap gate 


4 
5 
6 
7 
Cc 
E 
F 
0 
1 
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gate descriptors are call gates, task gates, 
interrupt gates, and trap gates. Gates provide a 
level of indirection between the source and destina- 
tion of the control transfer. This indirection allows 
the processor to automatically perform protection 
checks. It also allows system designers to control 
entry points to the operating system. Call gates are 
used to change privilege levels (see section 4.4 
Protection), task gates are used to perform a task 
switch, and interrupt and trap gates are used to 
specify interrupt service routines. 


Figure 4-8 shows the format of the four types of gate 
descriptors. Call gates are primarily used to transfer 
program control to a more privileged level. The call 
gate descriptor consists of three fields: the access 
byte, a long pointer (selector and offset) which 
points to the start of a routine and a word count 
which specifies how many parameters are to be cop- 
ied from the caller’s stack to the stack of the called 
routine. The word count field is only used by call 
gates when there is a change in the privilege level, 
other types of gates ignore the word count field. 


Interrupt and trap gates use the destination selector 
and destination offset fields of the gate descriptor as 
a pointer to the start of the interrupt or trap handler 
routines. The difference between interrupt gates and 
trap gates is that the interrupt gate disables inter- 
rupts (resets the IF bit) while the trap gate does not. 


Descriptor contents are not valid 
Descriptor contents are valid 


DPL—least privileged level at which a task may access the gate. WORD COUNT 0-31—the number of parameters to copy from caller's stack 
to the called procedure's stack. The parameters are 32-bit quantities for 386 gates, and 16-bit quantities for 286 gates. 


DESTINATION 16-bit 


SELECTOR selector or 


Selector to the target code segment 


Selector to the target task state segment for task gate 


DESTINATION offset 
OFFSET 16-bit 286 
32-bit 386 


Entry point within the target code segment 


Figure 4-8. Gate Descriptor Formats 
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Task gates are used to switch tasks. Task gates 
may only refer to a task state segment (see section 
4.4.6 Task Switching) therefore only the destination 
selector portion of a task gate descriptor is used, 
and the destination offset is ignored. 


Exception 13 is generated when a destination selec- 
tor does not refer to a correct descriptor type, i.e. a 
code segment for an interrupt, trap or call gate, a 
TSS for a task gate. 


The access byte format is the same for all gate de- 
scriptors. P=1 indicates that the gate contents are 
valid. P=0 indicates the contents are not valid and 
causes exception 11 if referenced. DPL is the de- 
scriptor privilege level and specifies when this de- 
scriptor may be used by a task (see section 4.4 
Protection). The S field bit 4 of the access rights 
byte must be 0 to indicate a system control descrip- 
tor. The type field specifies the descriptor type as 
indicated in Figure 4-8. 


4.3.4.7 DIFFERENCES BETWEEN 386 AND 286 
DESCRIPTORS 


In order to provide operating system compatibility 
between the 80286 and 80386, the 386 supports all 
of the 80286 segment descriptors. Figure 4-9 shows 
the general format of an 80286 system segment de- 
scriptor. The only differences between 286 and 386 
descriptor formats are that the values of the type 
fields, and the limit and base address fields have 
been expanded for the 386. The 80286 system seg- 
ment descriptors contained a 24-bit base address 
and 16-bit limit, while the 386 system segment de- 
scriptors have a 32-bit base address, a 20-bit limit 
field, and a granularity bit. 


By supporting 80286 system segments the 80386 is 
able to execute 286 application programs on a 
80386 operating system. This is possible because 
the processor automatically understands which de- 
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scriptors are 286-style descriptors and which de- 
scriptors are 386-style descriptors. In particular, if 
the upper word of a descriptor is zero then that de- 
scriptor is a 286-style descriptor. 


The only other differences between 286-style de- 
scriptors and 386 descriptors is the interpretation of 
the word count field of call gates and the B bit. The 
word count field specifies the number of 16-bit quan- 
tities to copy for 286 call gates and 32-bit quantities 
for 386 call gates. The B bit controls the size of 
PUSHes when using a call gate; if B=0 PUSHes are 
16 bits, if B=1 PUSHes are 32 bits. 


4.3.4.8 SELECTOR FIELDS 


A selector in Protected Mode has three fields: Local 
or Global Descriptor Table Indicator (Tl), Descriptor 
Entry Index (Index), and Requestor (the selector’s) 
Privilege Level (RPL) as shown in Figure 4-10. The 
TI bits select one of two memory-based tables of 
descriptors (the Global Descriptor Table or the Local 
Descriptor Table). The Index selects one of 8K de- 
scriptors in the appropriate descriptor table. The 
RPL bits allow high speed testing of the selector’s 
privilege attributes. 


4.3.4.9 SEGMENT DESCRIPTOR CACHE 


In addition to the selector value, every segment reg- 
ister has a segment descriptor cache register asso- 
ciated with it. Whenever a segment register’s con- 
tents are changed, the 8-byte descriptor associated 
with that selector is automatically loaded (cached) 
on the chip. Once loaded, all references to that seg- 
ment use the cached descriptor information instead 
of reaccessing the descriptor. The contents of the 
descriptor cache are not visible to the programmer. 
Since descriptor caches only change when a seg- 
ment register is changed, programs which modify 
the descriptor tables must reload the appropriate 
segment registers after changing a descriptor’s val- 
ue. 


SEGMENT BASE 15. SEGMENT LIMIT 15. 


Intel Reserved 
Set to 0 


Base Address of the segment 
The length of the segment 


Present Bit 1=Present O=Not Present 


rh 


Descriptor Privilege Level 0-3 
System Descriptor O=System 1=User 


nee Type of Segment 


Figure 4-9. 286 Code and Data Segment Descriptors 
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SELECTOR 


4321 


SEGMENT 
REGISTER 


INDICATOR 


es DESCRIPTOR 
ae as 


NUMBER 
DESCRIPTOR 
LOCAL GLOBAL 


DESCRIPTOR DESCRIPTOR 
TABLE TABLE 


Figure 4-10. Example Descriptor Selection 
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4.3.4.10 SEGMENT DESCRIPTOR REGISTER 
SETTINGS 


The contents of the segment descriptor cache vary 
depending on the mode the 80386 is operating in. 
When operating in Real Address Mode, the segment 
base, limit, and other attributes within the segment 
cache registers are defined as shown in Figure 4-11. 


SEGMENT 


32- BIT BASE 


(UPDATED DURING SELECTOR 
LOAD INTO SEGMENT REGISTER) 


CONFORMING PRIVILEGE 


EXPANSION DIRECTION 
GRANULARITY 
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For compatiblity with the 8086 architecture, the base 
is set to sixteen times the current selector value, the 
limit is fixed at OOOOFFFFH, and the attributes are 
fixed so as to indicate the segment is present and 
fully usable. In Real Address Mode, the internal 
“privilege level” is always fixed to the highest level, 
level 0, so I/O and other privileged opcodes may be 
executed. 


DESCRIPTOR CACHE REGISTER CONTENTS 


- BIT LIMIT 
(FIXED) 


OTHER ATTRIBUTES 
(FIXED) 


16X CURRENT ES SELECTOR OOOOFFFFH |Y 
16X CURRENT FS SELECTOR OOOOFFFFH |Y 


16X CURRENT GS SELECTOR 


*Except the 32-bit CS base is initialized to FFFFFOOOH after reset until first intersegment control transfer (e.g. intersegment CALL, or 


intersegment JMP, or INT). (See Figure 4-13 Example.) 
Key: Y yes 

no 

privilege level 0 

privilege level 1 

privilege level 2 

privilege level 3 

expand up 


ooennnn 


expand down 

byte granularity 

page granularity 

push/pop 16-bit words 

= push/pop 32-bit dwords 

= does not apply to that segment cache register 


Figure 4-11. Segment Descriptor Caches for Real Address Mode 
(Segment Limit and Attributes are Fixed) 
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When operating in Protected Mode, the segment according to the contents of the segment descriptor 
base, limit, and other attributes within the segment indexed by the selector value loaded into the seg- 
cache registers are defined as shown in Figure 4-12. ment register. 

In Protected Mode, each of these fields are defined 


SEGMENT DESCRIPTOR CACHE REGISTER CONTENTS 
32 BIT BASE 32 = BIT LIMIT OTHER ATTRIBUTES 


(UPDATED DURING (UPDATED DURING (UPDATED DURING 
SELECTOR LOAD INTO SELECTOR LOAD INTO SELECTOR LOAD INTO 
SEGMENT REGISTER) SEGMENT REGISTER) SEGMENT REGISTER) 


CONFORMING PRIVILEGE 
STACK SIZE 
EXECUTABLE 
WRITEABLE 

READABLE 

EXPANSION DIRECTION 
GRANULARITY 
ACCESSED 

PRIVILEGE LEVEL 


BASE PER SEG DESCR LIMIT PER SEG DESCR 


231630-61 


= per segment descriptor 
= per segment descriptor; descriptor must indicate “present” to avoid exception 11 
(exception 12 in case of SS) 
' = per segment descriptor, but descriptor must indicate “readable” to avoid exception 13 
(special case for SS) 
w = per segment descriptor, but descriptor must indicate “writable” to avoid exception 13 
(special case for SS) 
— = does not apply to that segment cache register 


Figure 4-12. Segment Descriptor Caches for Protected Mode (Loaded per Descriptor) 
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When operating in a Virtual 8086 Mode within the 
Protected Mode, the segment base, limit, and other 
attributes within the segment cache registers are de- 
fined as shown in Figure 4-13. For compatibility with 
the 8086 architecture, the base is set to sixteen 
times the current selector value, the limit is fixed at 


OOOOFFFFH, and the attributes are fixed so as to 
indicate the segment is present and fully usable. The 
virtual program executes at lowest privilege level, 
level 3, to allow trapping of all |OPL-sensitive in- 
structions and level-0-only instructions. 


SEGMENT DESCRIPTOR CACHE REGISTER CONTENTS 
32 = BIT LIMIT OTHER ATTRIBUTES 
(FIXED) (FIXED) 


32 - BIT BASE 


(UPDATED DURING SELECTOR 
LOAD INTO SEGMENT REGISTER) 


CONFORMING PRIVILEGE 


EXPANSION DIRECTION 
GRANULARITY 
ACCESSED 

PRIVILEGE LEVEL 


16X CURRENT SS SELECTOR 


OOOOFFFFH 


16X CURRENT DS SELECTOR 


16X CURRENT FS SELECTOR 


OOOOFFFFH 


16X CURRENT GS SELECTOR 


Privilege level 0 
privilege level 1 
privilege level 2 
privilege level 3 
expand up 


riuu nnd 


Con-o7z~< 


231630-62 


expand down 

byte granularity 

Page granularity 

push/pop 16-bit words 

push/pop 32-bit dwords 

does not apply to that segment cache register 


mound 


Figure 4-13. Segment Descriptor Caches for Virtual 8086 Mode within Protected Mode 
(Segment Limit and Attributes are Fixed) 
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4.4 PROTECTION 


4.4.1 Protection Concepts 


OPERATING 
SYSTEM 
INTERFACE 


Figure 4-14. Four-Level Hierachical Protection 


The 80386 has four levels of protection which are 
optimized to support the needs of a multi-tasking op- 
erating system to isolate and protect user programs 
from each other and the operating system. The privi- 
lege levels control the use of privileged instructions, 
\/O instructions, and access to segments and seg- 
ment descriptors. Unlike traditional microprocessor- 
based systems where this protection is achieved 
only through the use of complex external hardware 
and software the 80386 provides the protection as 
part of its integrated Memory Management Unit. The 
80386 offers an additional type of protection on a 
page basis, when paging is enabled (See section 
4.5.3 Page Level Protection). 


The four-level hierarchical privilege system is illus- 
trated in Figure 4-14. It is an extension of the user/ 
supervisor privilege mode commonly used by mini- 
computers and, in fact, the user/supervisor mode is 
fully supported by the 80386 paging mechanism. 
The privilege levels (PL) are numbered 0 through 3. 
Level 0 is the most privileged or trusted level. 


4.4.2 Rules of Privilege 


The 80386 controls access to both data and proce- 
dures between levels of a task, according to the fol- 
lowing rules. 


© Data stored in a segment with privilege level p can 


be accessed only by code executing at a privilege 
level at least as privileged as p. 
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¢ A code segment/procedure with privilege level p 
can only be called by a task executing at the same 
or a lesser privilege level than p. 


4.4.3 Privilege Levels 


4.4.3.1 TASK PRIVILEGE 


At any point in time, a task on the 80386 always 
executes at one of the four privilege levels. The Cur- 
rent Privilege Level (CPL) specifies the task’s privi- 
lege level. A task’s CPL may only be changed by 
control transfers through gate descriptors to a code 
segment with a different privilege level. (See section 
4.4.4 Privilege Level Transfers) Thus, an applica- 
tion program running at PL = 3 may call an operat- 
ing system routine at PL = 1 (via a gate) which 
would cause the task’s CPL to be set to 1 until the 
operating system routine was finished. 


4.4.3.2 SELECTOR PRIVILEGE (RPL) 


The privilege level of a selector is specified by the 
RPL field. The RPL is the two least significant bits of 
the selector. The selector’s RPL is only used to es- 
tablish a less trusted privilege level than the current 
privilege level for the use of a segment. This level is 
called the task’s effective privilege level (EPL). The 
EPL is defined as being the least privileged (i.e. nu- 
merically larger) level of a task’s CPL and a selec- 
tor’s RPL. Thus, if selector’s RPL = 0 then the CPL 
always specifies the privilege level for making an ac- 
cess using the selector. On the other hand if RPL = 
3 then a selector can only access segments at level 
3 regardless of the task’s CPL. The RPL is most 
commonly used to verify that pointers passed to an 
operating system procedure do not access data that 
is of higher privilege than the procedure that origi- 
nated the pointer. Since the originator of a selector 
can specify any RPL value, the Adjust RPL (ARPL) 
instruction is provided to force the RPL bits to the 
originator’s CPL. 


4.4.3.3 1/O PRIVILEGE 


The |/O privilege level (IOPL) lets the operating sys- 
tem code executing at CPL = 0 define the least 
privileged level at which I/O instructions can be 
used. An exception 13 (General Protection Violation) 
is generated if an I/O instruction is attempted when 
the CPL of the task is less privileged then the IOPL. 
The IOPL is stored in bits 13 and 14 of the EFLAGS 
register. The following instructions cause an excep- 
tion 13 if CPL is greater than IOPL: IN, INS, OUT, 
OUTS, STI, CLI, LOCK prefix. 


4.4.3.4 PRIVILEGE VALIDATION 


The 80386 provides several instructions to speed 
pointer testing and help maintain system integrity by 
verifying that the selector value refers to an appro- 
priate segment. Table 4-2 summarizes the selector 
validation procedures available for the 80386. 


Table 4-2. Pointer Test Instructions 


instruction|Operands|___—Function 


Selector, | Adjust Requested Privi- 

Register | lege Level: adjusts the 
RPL of the selector to the 
numeric maximum of 
current selector RPL value 
and the RPL value in the 
register. Set zero flag if 
selector RPL was 
changed. 


VERify for Read: sets the 
zero flag if the segment 
referred to by the selector 
can be read. 


VERify for Write: sets the 
zero flag if the segment 
referred to by the selector 
can be written. 


Load Segment Limit: reads 
the segment limit into the 
register if privilege rules 
and descriptor type allow. 
Set zero flag is successful. 


Load Access Rights: reads 
the descriptor access 
rights byte into the register 
if privilege rules allow. Set 
zero flag if successful. 


This pointer verification prevents the common prob- 
lem of an application at PL = 3 calling a operating 
systems routine at PL = 0 and passing the operat- 
ing system routine a “bad” pointer which corrupts a 
data structure belonging to the operating system. If 
the operating system routine uses the ARPL instruc- 
tion to ensure that the RPL of the selector has no 
greater privilege than that of the caller, then this 
problem can be avoided. 
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4.4.3.5 DESCRIPTOR ACCESS 


There are basically two types of segment accesses: 
those involving code segments such as control 
transfers, and those involving data accesses. Deter- 
mining the ability of a task to access a segment in- 
volves the type of segment to be accessed, the in- 
struction used, the type of descriptor used and CPL, 
RPL, and DPL as described above. 


Any time an instruction loads data segment registers 
(DS, ES, FS, GS) the 80386 makes protection vali- 
dation checks. The processor first checks to see if 
the segment is not a null segment, an invalid seg- 
ment generates an exception 11. Then it checks to 
see if the selector refers to the correct type of seg- 
ment. Selectors loaded in the DS, ES, FS, GS regis- 
ters must refer only to data segment or readable 
code segments. The data access rules are specified 
in section 4.2.2 Rules of Privilege. The only excep- 
tion to those rules is readable conforming code seg- 
ments which can be accessed at any privilege level. 


Finally the privilege validation checks are performed. 
The CPL is compared to the EPL and if the EPL is 
more privileged than the CPL an exception 13 (gen- 
eral protection fault) is generated. 


The rules regarding the stack segment are slightly 
different than those involving data segments. In- 
structions that load selectors into SS must refer to 
data segment descriptors for writeable data seg- 
ments. The DPL and RPL must equal the CPL. All 
other descriptor types or a privilege level violation 
will cause exception 13. A stack not present fault 
causes exception 12. Note that an exception 11 is 
used for a not-present code or data segment. 


4.4.4 Privilege Level Transfers 


Inter-segment control transfers occur when a selec- 
tor is loaded in the CS register. For a typical system 
most of these transfers are simply the result of a call 
or a jump to another routine. There are five types of 
control transfers which are summarized in Table 4-3. 
Many of these transfers result in a privilege level 
transfer. Changing privilege levels is done only via 
control transfers, by using gates, task switches, and 
interrupt or trap gates. 


Control transfers can only occur if the operation 
which loaded the selector references the correct de- 
scriptor type. Any violation of these descriptor usage 
rules will cause an exception 13 (e.g. JMP through a 
call gate, or IRET from a normal subroutine call). 
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Table 4-3. Descriptor Types Used for Control Transfer 


Descriptor Descriptor 
Control Transfer Types Operation Types 


Intersegment within the same privilege level JMP, CALL, RET, IRET* | Code Segment | GDT/LDT 
Intersegment to the same or higher privilege level | CALL Call Gate GDT/LDT 


Interrupt within task may change CPL Interrupt Instruction, Trap or IDT 
Exception, External Interrupt 
Interrupt Gate 
Intersegment to a lower privilege level RET, IRET* Code Segment | GDT/LDT 
(changes task CPL) 
CALL, JMP Task State GDT 
Segment 
IDT 


; CALL, JMP Task Gate GDT/LDT 
Task Switch 
IRET** Task Gate 
Interrupt Instruction, 
Exception, External 


Interrupt 


*NT (Nested Task bit of flag word) = 0 
**NT (Nested Task bit of flag word) = 1 


In order to provide further system security, all control — Task switches can be performed by a CALL, 

transfers are also subject to the privilege rules. JMP, or INT which references either a task gate 

or task state segment who’s DPL is less privi- 

The privilege rules require that: leged or the same privilege as the old task’s CPL. 
— Privilege level transitions can only occur via 

cenen” “ d ' Any control transfer that changes CPL within a task 


; causes a change of stacks as a result of the privi- 
—JMPs must be made to a non-conforming code —_jege level change. The initial values of SS:ESP for 
segment with the same privilege. privilege levels 0, 1, and 2 are retained in the task 
— CALLs can be made to a non-conforming code state segment (see section 4.4.6 Task Switching). 
segment with the same privilege or via a gate toa During a JMP or CALL control transfer, the new 


more privileged level. stack pointer is loaded into the SS and ESP regis- 
— Interrupts handled within the task obey the same ters and the previous stack pointer is pushed onto 
privilege rules as CALLs. the new stack. 


— Conforming Code segments are accessible by = When RETurning to the original privilege level, use 


privilege levels which are the same or less privi- of the lower-privileged stack is restored as part of 
leged than the conforming-code segment's DPL. the RET or IRET instruction operation. For subrou- 
— Both the requested privilege level (RPL) in the tine calls that pass parameters on the stack and 
selector pointing to the gate and the task’s CPL cross privilege levels, a fixed number of words (as 
must be of equal or greater privilege than the specified in the gate’s word count field) are copied 


gate’s DPL. from the previous stack to the current stack. The 
— The code segment selected in the gate must be inter-segment RET instruction with a stack adjust- 
the same or more privileged than the task’s CPL. ment value will correctly restore the previous stack 


ointer upon return. 
— Return instructions that do not switch tasks can P p 


only return control to a code segment with same 
or less privilege. 
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4.4.5 Call Gates 


Gates provide protected, indirect CALLs. One of the 
major uses of gates is to provide a secure method of 
privilege transfers within a task. Since the operating 
system defines all of the gates in a system, it can 
ensure that all gates only allow entry into a few trust- 
ed procedures (such as those which allocate memo- 
ry, or perform I/O). 


Gate descriptors follow the data access rules of priv- 
ilege; that is, gates can be accessed by a task if the 
EPL, is equal to or more privileged than the gate 
descriptor’s DPL. Gates follow the control transfer 
rules of privilege and therefore may only transfer 
control to a more privileged level. 


Call Gates are accessed via a CALL instruction and 
are syntactically identical to calling a normal subrou- 
tine. When an inter-level 386 call gate is activated, 
the following actions occur. 


1. Load CS:EIP from gate check for validity 
2. SS is pushed zero-extended to 32 bits 
3. ESP is pushed 


4. Copy Word Count 32-bit parameters from the 
old stack to the new stack 


5. Push Return address on stack 


The procedure is identical for 286 Call gates, except 
that 16-bit parameters are copied and 16-bit regis- 
ters are pushed. 


Interrupt Gates and Trap gates work in a similar 
fashion as the call gates, except there is no copying 
of parameters. The only difference between Trap 
and Interrupt gates is that control transfers through 
an Interrupt gate disables further interrupts (i.e. the 
IF bit is set to 0), and Trap gates leave the interrupt 
status unchanged. 


4.4.6 Task Switching 


A very important attribute of any multi-tasking/multi- 
user operating systems is its ability to rapidly switch 
between tasks or processes. The 80386 directly 
supports this operation by providing a task switch 


instruction in hardware. The 80386 task switch oper- 
ation saves the entire state of the machine (all of the 
registers, address space, and a link to the previous 
task), loads a new execution state, performs protec- 
tion checks, and commences execution in the new 
task, in about 17 microseconds. Like transfer of con- 
trol via gates, the task switch operation is invoked by 
executing an inter-segment JMP or CALL instruction 
which refers to a Task State Segment (TSS), or a 
task gate descriptor in the GDT or LDT. An INT n 
instruction, exception, trap, or external interrupt may 
also invoke the task switch operation if there is a 
task gate descriptor in the associated IDT descriptor 
slot. 


The TSS descriptor points to a segment (see Figure 
4-15) containing the entire 80386 execution state 
while a task gate descriptor contains a TSS selector. 
The 80386 supports both 286 and 386 style TSSs. 
Figure 4-16 shows a 286 TSS. The limit of a 386 
TSS must be greater than 0064H (002BH for a 286 
TSS), and can be as large as 4 Gigabytes. In the 
additional TSS space, the operating system is free 
to store additional information such as the reason 
the task is inactive, time the task has spent running, 
and open files belong to the task. 


Each task must have a TSS associated with it. The 
current TSS is identified by a special register in the 
80386 called the Task State Segment Register (TR). 
This register contains a selector referring to the task 
state segment descriptor that defines the current 
TSS. A hidden base and limit register associated 
with TR are loaded whenever TR is loaded with a 
new selector. Returning from a task is accomplished 
by the IRET instruction. When IRET is executed, 
control is returned to the task which was interrupted. 
The current executing task’s state is saved in the 
TSS and the old task state is restored from its TSS. 


Several bits in the flag register and machine status 
word (CRO) give information about the state of a 
task which are useful to the operating system. The 
Nested Task (NT) (bit 14 in EFLAGS) controls the 
function of the IRET instruction. If NT = 0, the IRET 
instruction performs the regular return; when NT = 
1, IRET performs a task switch operation back to the 
previous task. The NT bit is set or reset in the follow- 
ing fashion: 
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Figure 4-16. 286 TSS 


When a CALL or INT instruction initiates a task 
switch, the new TSS will be marked busy and the 
back link field of the new TSS set to the old TSS 
selector. The NT bit of the new task is set by CALL 
or INT initiated task switches. An interrupt that does 
not cause a task switch will clear NT. (The NT bit will 
be restored after execution of the interrupt handler) 
NT may also be set or cleared by POPF or IRET 
instructions. 


The 386 task state segment is marked busy by 
changing the descriptor type field from TYPE 9H to 
TYPE BH. A 286 TSS is marked busy by changing 
the descriptor type field from TYPE 1 to TYPE 3. 
Use of a selector that references a busy task state 
segment causes an exception 13. 


The Virtual Mode (VM) bit 17 is used to indicate if a 
task, is a virtual 8086 task. If VM = 1, then the tasks 
will use the Real Mode addressing mechanism. The 
virtual 8086 environment is only entered and exited 
via a task switch (see section 4.6 Virtual Mode). 


The coprocessor’s state is not automatically saved 
when a task switch occurs, because the incoming 
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task may not use the coprocessor. The Task 
Switched (TS) Bit (bit 3 in the CRO) helps deal with 
the coprocessor’s state in a multi-tasking environ- 
ment. Whenever the 80386 switches task, it sets the 
TS bit. The 80386 detects the first use of a proces- 
sor extension instruction after a task switch and 
causes the processor extension not available excep- 
tion 7. The exception handler for exception 7 may 
then decide whether to save the state of the co- 
processor. A processor extension not present ex- 
ception (7) will occur when attempting to execute an 
ESC or WAIT instruction if the Task Switched and 
Monitor coprocessor extension bits are both set (i.e. 
TS = 1 and MP = 1). 


The T bit in the 386 TSS indicates that the processor 
should generate a debug exception when switching 
to a task. If T = 1 then upon entry to a new task a 
debug exception 1 will be generated. 


4.4.7 Initialization and Transition to 
Protected Mode 


Since the 80386 begins executing in Real Mode im- 
mediately after RESET it is necessary to initialize the 
system tables and registers with the appropriate val- 
ues. 


The GDT and IDT registers must refer to a valid GDT 
and IDT. The IDT should be at least 256 bytes long, 
and GDT must contain descriptors for the initial 
code, and data segments. Figure 4-17 shows the 
tables and Figure 4-18 the descriptors needed for a 
simple Protected Mode 80386 system. It has a sin- 
gle code and single data/stack segment each four 
gigabytes long and a single privilege level PL = 0. 


The actual method of enabling Protected Mode is to 
load CRO with the PE bit set, via the MOV CRO, R/M 
instruction. This puts the 80386 in Protected Mode. 


After enabling Protected Mode, the next instruction 
should execute an intersegment JMP to load the CS 
register and flush the instruction decode queue. The 
final step is to load all of the data segment registers 
with the initial selector values. 


An alternate approach to entering Protected Mode 
which is especially appropriate for multi-tasking op- 
erating systems, is to use the built in task-switch to 
load all of the registers. In this case the GDT would 
contain two TSS descriptors in addition to the code 
and data descriptors needed for the first task. The 
first JMP instruction in Protected Mode would jump 
to the TSS causing a task switch and loading all of 
the registers with the values stored in the TSS. The 
Task State Segment Register should be initialized to 
point to a valid TSS descriptor since a task switch 
saves the state of the current task in a task state 
segment. 
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Figure 4-17. Simple Protected System 
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Figure 4-18. Descriptors for Simple System 


4.4.8 Tools for Building Protected 
Systems 


In order to simplify the design of a protected multi- 
tasking system, Intel provides a tool which allows 
the system designer an easy method of constructing 
the data structures needed for a Protected Mode 
80386 system. This tool is the builder BLD-386™. 
BLD-386 lets the operating system writer specify all 
of the segment descriptors discussed in the previous 
sections (LDTs, IDTs, GDTs, Gates, and TSS) in a 
high-level language. 
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4.5 PAGING 


4.5.1 Paging Concepts 


Paging is another type of memory management use- 
ful for virtual memory multitasking operating sys- 
tems. Unlike segmentation which modularizes pro- 
grams and data into variable length segments, pa- 
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ging divides programs into multiple uniform size 
pages. Pages bear no direct relation to the logical 
structure of a program. While segment selectors can 
be considered the logical “name” of a program 
module or data structure, a page most likely corre- 
sponds to only a portion of a module or data struc- 
ture. 


By taking advantage of the locality of reference dis- 
played by most programs, only a small number of 
pages from each active task need be in memory at 
any one moment. 


4.5.2 Paging Organization 


4.5.2.1 PAGE MECHANISM 


The 80386 uses two levels of tables to translate the 
linear address (from the segmentation unit) into a 
physical address. There are three components to 
the paging mechanism of the 80386: the page direc- 
tory, the page tables, and the page itself (page 
frame). All memory-resident elements of the 80386 
paging mechanism are the same size, namely, 4K 
bytes. A uniform size for all of the elements simpli- 
fies memory allocation and reallocation schemes, 
since there is no problem with memory fragmenta- 
tion. Figure 4-19 shows how the paging mechanism 
works. 
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4.5.2.2 PAGE DESCRIPTOR BASE REGISTER 


CR2 is the Page Fault Linear Address register. It 
holds the 32-bit linear address which caused the last 
page fault detected. 


CR3 is the Page Directory Physical Base Address 
Register. It contains the physical starting address of 
the Page Directory. The lower 12 bits of CR3 are 
always zero to ensure that the Page Directory is al- 
ways page aligned. Loading it via a MOV CR3, reg 
instruction causes the Page Table Entry cache to be 
flushed, as will a task switch through a TSS which 
changes the value of CRO. (See 4.5.4 Translation 
Lookaside Buffer). 


4.5.2.3 PAGE DIRECTORY 


The Page Directory is 4K bytes long and allows up to 
1024 Page Directory Entries. Each Page Directory 
Entry contains the address of the next level of ta- 
bles, the Page Tables and information about the 
page table. The contents of a Page Directory Entry 
are shown in Figure 4-20. The upper 10 bits of the 
linear address (A22—A31) are used as an index to 
select the correct Page Directory Entry. 


TWO LEVEL PAGING SCHEME 


LINEAR 
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DIRECTORY 


CONTROL REGISTERS 


USER 
MEMORY 
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Figure 4-19. Paging Mechanism 
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Figure 4-20. Page Directory Entry (Points to Page Table) 
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PAGE FRAME ADDRESS 31..12 
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Figure 4-21. Page Directory Entry (Points to Page Table) 


4.5.2.4 PAGE TABLES 


Each Page Table is 4K bytes and holds up to 1024 
Page Table Entries. Page Table Entries contain the 
starting address of the page frame and statistical 
information about the page (see Figure 4-21). Ad- 
dress bits A12-A21 are used as an index to select 
one of the 1024 Page Table Entries. The 20 upper- 
bit page frame address is concatenated with the 
lower 12 bits of the linear address to form the physi- 
cal address. Page tables can be shared between 
tasks and swapped to disks. 


4.5.2.5 PAGE DIRECTORY/TABLE ENTRIES 


The lower 12 bits of the Page Table Entries and 
Page Directory Entries contain statistical information 
about pages and page tables respectively. The P 
(Present) bit 0 indicates if a Page Directory or Page 
Table entry can be used in address translation. If 
P = 1 the entry can be used for address translation 
if P = 0 the entry can not be used for translation, 
and all of the other bits are available for use by the 
software. For example the remaining 31 bits could 
be used to indicate where on the disk the page is 
stored. 


The A (Accessed) bit 5, is set by the 80386 for both 
types of entries before a read or write access occurs 
to an address covered by the entry. The D (Dirty) bit 
6 is set to 1 before a write to an address covered by 
that page table entry occurs. The D bit is undefined 
for Page Directory Entries. When the P, A and D bits 
are updated by the 80386, the processor generates 
a Read-Modify-Write cycle which locks the bus and 
prevents conflicts with other processors or perpheri- 
als. Software which modifies these bits should use 
the LOCK prefix to ensure the integrity of the page 
tables in multi-master systems. 


The 3 bits marked OS Reserved in Figure 4-20 and 
Figure 4-21 (bits 9-11) are software definable. OSs 
are free to use these bits for whatever purpose they 
wish. An example use of the OS Reserved bits 
would be to store information about page aging. By 
keeping track of how long a page has been in mem- 
ory since being accessed, an operating system can 
implement a page replacement algorithm like Least 
Recently Use. 


The (User/Supervisor) U/S bit 2 and the (Read/ 
Write) R/W bit 1 are used to provide protection attri- 
butes for individual pages. 
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4.5.3 Page Level Protection 
(R/W, U/S Bits) 


The 80386 provides a set of protection attributes for 
paging systems. The paging mechanism distin- 
guishes between two levels of protection: User 
which corresponds to level 3 of the segmentation 
based protection, and supervisor which encompass- 
es all of the other protection levels (0, 1, 2). Pro- 
grams executing at Level 0, 1 or 2 bypass the page 
protection, although segmentation based protection 
is still enforced by the hardware. 


The U/S and R/W bits are used to provide User/Su- 
pervisor and Read/Write protection for individual 
pages or for all pages covered by a Page Table Di- 
rectory Entry. The U/S and R/W bits in the second 
level Page Table Entry apply only to the page de- 
scribed by that entry. 


While the U/S and R/W bits in the first level Page 
Directory Table apply to all pages described by the 
page table pointed to by that directory entry. The 
U/S and R/W bits for a given page are obtained by 
taking the most restrictive of the U/S and R/W from 
the Page Directory Table Entries and the Page Table 
Entries and using these bits to address the page. 


Example: If the U/S and R/W bits for the Page Di- 
rectory entry was 10 and the U/S R/W bits for the 
Page Table Entry were 01, the access rights for the 
page would be 01, the numerically smaller of the 
two. Table 4-4 shows the affect of the U/S and R/W 
bits on accessing memory. 


Table 4-4. Protection Provided by R/W and U/S 


Permitted | Permitted Access 
Levels 0, 1, or 2 


Read/Write 
Read/Write 
Read/Write 
Read/Write 


None 


None 
Read-Only 
Read/Write 


However a given segment can be easily made read- 
only for level 0, 1, or 2 via the use of segmented 
protection mechanisms. (Section 4.4 Protection). 


intel 


4.5.4 Translation Lookaside Buffer 


The 80386 paging hardware is designed to support 
demand paged virtual memory systems. However, 
performance would degrade substantially if the proc- 
essor was required to access two levels of tables for 
every memory reference. To solve this problem, the 
80386 keeps a cache of the most recently accessed 
pages, this cache is called the Translation Looka- 
side Buffer (TLB). The TLB is a four-way set associa- 
tive 32-entry page table cache. It automatically 
keeps the most commonly used Page Table Entries 
in the processor. The 32-entry TLB coupled with a 
4K page size, results in coverage of 128K bytes of 
memory addresses. For many common multi-tasking 
systems, the TLB will have a hit rate of about 98%. 
This means that the processor will only have to ac- 
cess the two-level page structure on 2% of all mem- 
ory references. Figure 4-22 illustrates how the TLB 
complements the 80386’s paging mechanism. 


4.5.5 Paging Operation 


32 ENTRIES 
PHYSICAL 
MEMORY 
TRANSLATION 
LOOKASIDE 
BUFFER 


PAGE PAGE 
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@ 98% HIT RATE 


DIRECTORY 


Figure 4-22. Translation Lookaside Buffer 


The paging hardware operates in the following fash- 
ion. The paging unit hardware receives a 32-bit lin- 
ear address from the segmentation unit. The upper 
20 linear address bits are compared with all 32 en- 
tries in the TLB to determine if there is a match. If 
there is a match (i.e. a TLB hit), then the 32-bit phys- 
ical address is calculated and will be placed on the 
address bus. 


However, if the page table entry is not in the TLB, 
the 80386 will read the appropriate Page Directory 
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Entry. If P = 1 on the Page Directory Entry indicat- 
ing that the page table is in memory, then the 80386 
will read the appropriate Page Table Entry and set 
the Access bit. If P = 1 on the Page Table Entry 
indicating that the page is in memory, the 80386 will 
update the Access and Dirty bits as needed and 
fetch the operand. The upper 20 bits of the linear 
address, read from the page table, will be stored in 
the TLB for future accesses. However if P = 0 for 
either the Page Directory Entry or the Page Table 
Entry, then the processor will generate a page fault 
an Exception 14. 


The processor will also generate an exception 14, 
page fault, if the memory reference violated the 
page protection attributes (i.e. U/S or R/W) (e.g. try- 
ing to write to a read-only page). CR2 will hold the 
linear address which caused the page fault. Since 
Exception 14 is classified as a fault CS: EIP will point 
to the instruction causing the page-fault. The 16-bit 
error code pushed as part of the page fault handler 
will contain status bits which indicate the cause of 
the page fault. 


The 16-bit error code is used by the operating sys- 
tem to determine how to handle the page fault Fig- 
ure 4-23A shows the format of the page-fault error 
code and the interpretation of the bits. 


NOTE: 
Even though the bits in the error code (U/S, W/R, 
and P) have similar names as the bits in the Page 
Directory/Table Entries, the interpretation of the er- 
ror code bits is different. Figure 4-23B indicates 
what type of access caused the page fault. 


15 3210 
U|W 
U|U}U}U/U}U}U}U;U;U;U;U;UyU 
S|R 


Figure 4-23A. Page Fault Error Code Format 


U/S: The U/S bit indicates whether the access 
causing the fault occurred when the processor was 
executing in User Mode (U/S = 1) or in Supervisor 
mode (U/S = 0) 


W/R: The W/R bit indicates whether the access 
causing the fault was a Read (W/R = 0) or a Write 
(W/R = 1) 

P: The P bit indicates whether a page fault was 
caused by a not-present page (P = 0), or by a page 
level protection violation (P = 1) 


U: UNDEFINED 
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Access Type 
Supervisor* Read 


Supervisor Write 
User Read 
User Write 


*Descriptor table access will fault with U/S = 0, even if the program 
is executing at level 3. 


Figure 4-23B. Type of Access 
Causing Page Fault 


4.5.6 Operating System 
Responsibilities 


The 80386 takes care of the page address transla- 
tion process, relieving the burden from an operating 
system in a demand-paged system. The operating 
system is responsible for setting up the initial page 
tables, and handling any page faults. The operating 
system also is required to invalidate (i.e. flush) the 
TLB when any changes are made to any of the page 
table entries. The operating system must reload 
CR3 to cause the TLB to be flushed. 


Setting up the tables is simply a matter of loading 
CR3 with the address of the Page Directory, and 
allocating space for the Page Directory and the 
Page Tables. The primary responsibility of the oper- 
ating system is to implement a swapping policy and 
handle all of the page faults. 


A final concern of the operating system is to ensure 
that the TLB cache matches the information in the 
paging tables. In particular, any time the operating 
systems set the P present bit of page table entry to 
zero the TLB must be flushed. Operating systems 
may want to take advantage of the fact that CR3 is 
stored as part of a TSS, to give every task or group 
of tasks its own set of page tables. 


4.6 VIRTUAL 8086 ENVIRONMENT 


4.6.1 Executing 8086 Programs 


The 80386 allows the execution of 8086 application 
programs in both Real Mode and in the Virtual 8086 
Mode (Virtual Mode). Of the two methods, Virtual 
8086 Mode offers the system designer the most 
flexibility. The Virtual 8086 Mode allows the execu- 
tion of 8086 applications, while still allowing the sys- 
tem designer to take full advantage of the 80386 
protection mechanism. In particular, the 80386 al- 
lows the simultaneous execution of 8086 operating 
systems and its applications, and an 80386 operat- 
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ing system and both 80286 and 80386 applications. 
Thus, in a multi-user 80386 computer, one person 
could be running an MS-DOS spreadsheet, another 
person using MS-DOS, and a third person could be 
running multiple Unix utilities and applications. Each 
person in this scenario would believe that he had the 
computer completely to himself. Figure 4-24 illus- 
trates this concept. 


4.6.2 Virtual 8086 Mode Addressing 
Mechanism 


One of the major differences between 80386 Real 
and Protected modes is how the segment selectors 
are interpreted. When the processor is executing in 
Virtual 8086 Mode the segment registers are used in 
an identical fashion to Real Mode. The contents of 
the segment register is shifted left 4 bits and added 
to the offset to form the segment base linear ad- 
dress. 


The 80386 allows the operating system to specify 
which programs use the 8086 style address mecha- 
nism, and which programs use Protected Mode ad- 
dressing, on a per task basis. Through the use of 
paging, the one megabyte address space of the Vir- 
tual Mode task can be mapped to anywhere in the 4 
gigabyte linear address space of the 80386. Like 
Real Mode, Virtual Mode addresses that exceed one 
megabyte will cause an exception 13. However, 
these restrictions should not prove to be important, 
because most tasks running in Virtual 8086 Mode 
will simply be existing 8086 application programs. 


4.6.3 Paging In Virtual Mode 


The paging hardware allows the concurrent running 
of multiple Virtual Mode tasks, and provides protec- 
tion and operating system isolation. Although it is 
not strictly necessary to have the paging hardware 
enabled to run Virtual Mode tasks, it is needed in 
order to run multiple Virtual Mode tasks or to relo- 
cate the address space of a Virtual Mode task to 
physical address space greater than one megabyte. 


The paging hardware allows the 20-bit linear ad- 
dress produced by a Virtual Mode program to be 
divided into up to 256 pages. Each one of the pages 
can be located anywhere within the maximum 4 giga- 
byte physical address space of the 80386. In addi- 
tion, since CR3 (the Page Directory Base Register) 
is loaded by a task switch, each Virtual Mode task 
can use a different mapping scheme to map pages 
to different physical locations. Finally, the paging 
hardware allows the sharing of the 8086 operating 
system code between multiple 8086 applications. 
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Figure 4-24. Virtual 8086 Environment Memory Management 


Figure 4-24 shows how the 80386 paging hardware 
enables multiple 8086 programs to run under a virtu- 
al memory demand paged system. 


4.6.4 Protection 


All Virtual Mode programs execute at privilege level 
3. As such Virtual Mode programs are subject to all 
of the protection checks defined in Protected Mode. 
This is different than Real Mode which implicitly is 
executing at privilege level 0. Thus, an attempt to 
execute a privileged instruction in Virtual Mode will 
cause general protection fault (exception 13). Sever- 
al instructions are made IOPL-sensitive, thus the op- 
erating system can decide to trap I/O instructions 
and emulate them by setting the IOPL = 0, or to let 
1/O instructions work normally by setting IOPL = 3. 
Since Real Mode programs are always assumed to 
be executing at privilege level 0 no privileged or 
IOPL sensitive instruction faults can be generated. 
However, some instructions are used only in Pro- 
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tected Mode, these instructions generate undefined 
opcodes in both Real and Virtual Modes. 


The following instructions cause an exception 6 in 
both Real and Virtual 8086 Mode: 


ARPL, LAR, LSL, VERR, VERW, STR, LTR, SLDT, 
and LLDT. 


The following are privileged instructions. They can 
be used in Real Mode, but they cause a General 
Protection Exception (interrupt 13) in Virtual Mode or 
whenever the CPL > 0. 


LIDT, LGDT, LMSW, CTS, HLT, MOV DRn, REG; 
MOV REG, DRn; MOV CRn, REG; MOV REG, CRn; 
MOV TRn, REG; and MOV REG, TRn. 


The following instructions will generate a General 
Protection Exception (exception 13) when CPL > 
1OPL: 


INS, IN, OUTS, OUT, STI, CLI, and LOCK. 
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The INT n, PUSHF, POPF, and IRET instructions are 
made IOPL sensitive only when the processor is ex- 
ecuting in Virtual 8086 Mode. (Note that INT3 and 
INTO instructions are not made IOPL sensitive.) 


4.6.5 Interrupt Handling 


In order to fully support the emulation of an 8086 
machine, interrupts in Virtual 8086 Mode are han- 
dled in a unique fashion. When running in Virtual 
Mode all interrupts and exceptions involve a privi- 
lege change back to the host 80386 operating sys- 
tem. The 80386 operating system determines if the 
interrupt comes from a Protected Mode application 
or from a Virtual Mode program by examining the 
VM bit in the EFLAGS image stored on the stack. 


When a Virtual Mode program is interrupted and ex- 
ecution passes to the interrupt routine at level 0, the 
VM bit is cleared. However, the VM bit is still set in 
the EFLAG image on the stack. 


The 80386 operating system in turn handles the ex- 
ception or interrupt and then returns control to the 
8086 program. The 80386 operating system may 
choose to let the 8086 operating system handle the 
interrupt or it may emulate the function of the inter- 
rupt handler. For example, many 8086 operating 
system calls are accessed by PUSHing parameters 
on the stack, and then executing an INT n instruc- 
tion. If the IOPL is set to 0 then all INT n instructions 
will be intercepted by the 80386 operating system. 
The 80386 operating system could emulate the 
8086 operating system’s call. Figure 4-25 shows 
how the 80386 operating system could intercept an 
8086 operating system’s call to ‘Open a File”. 
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An 80386 operating system can provide a Virtual 
8086 Environment which is totally transparent to the 
application software via intercepting and then emu- 
lating 8086 operating system’s calls, and intercept- 
ing IN and OUT instructions. 


4.6.6 Entering and Leaving Virtual 
8086 Mode 


There are two methods for entering or leaving Virtual 
8086 Mode. A Virtual Mode task is entered by per- 
forming a CALL or JUMP to a TSS which has the VM 
bit set in the EFLAGS image. Upon exiting an inter- 
rupt handler at privilege level 0 a set VM bit also 
causes a return to Virtual Mode. The first method is 
used to start the execution of a Virtual Mode task, 
while the second method is used to return from serv- 
icing a Virtual Mode interrupt. 


Transition in and out of Virtual Mode results in a lev- 
el change and a stack switch. In addition, all of the 
segment register images are on the stack, and then 
loaded with null selectors. This will permit the inter- 
rupt handlers to save and restore the segment regis- 
ters as 80286 selectors, instead of 8086 style seg- 
ment registers. Interrupt routines which expect val- 
ues in the segment registers, will have to obtain 
these values by looking on the stack. 


Leaving Virtual Mode is accomplished by simply 
JMPing to a TSS (while at privilege level 0) which 
does not have the VM bit set. This causes a task 
switch. 
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8086 Application makes “Open File Call” —> causes 
General Protection Fault (Arrow #1) 

Virtual 8086 Monitor intercepts call. Calis 386 OS (Arrow #2) 
386 OS opens file returns control to 8086 OS (Arrow #3) 
8086 OS returns control to application. (Arrow #4) 
Transparent to Application 


Figure 4-25. Virtual 8086 Environment Interrupt and Call Handling 
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5. FUNCTIONAL DATA 


5.1 INTRODUCTION 


The 80386 features a straightforward functional in- 
terface to the external hardware. The 80386 has 
separate, parallel buses for data and address. The 
data bus is 32-bits in width, and bidirectional. The 
address bus outputs 32-bit address values in the 
most directly usable form for the high-speed local 
bus: 4 individual byte enable signals, and the 30 up- 
per-order bits as a binary value. The data and ad- 
dress buses are interpreted and controlled with their 
associated control signals. 


A dynamic data bus sizing feature allows the proc- 
essor to handle a mix of 32- and 16-bit external bus- 
es on a cycle-by-cycle basis (see 5.3.4 Data Bus 
Sizing). If 16-bit bus size is selected, the 80386 au- 
tomatically makes any adjustment needed, even 
performing another 16-bit bus cycle to complete the 
transfer if that is necessary. 8-bit peripheral devices 
may be connected to 32-bit or 16-bit buses with no 
loss of performance. A new address pipelining op- 
tion is provided and applies to 32-bit and 16-bit bus- 
es for substantially improved memory utilization, es- 
pecially for the most heavily used memory resourc- 
es. 


The address pipelining option, when selected, typ- 
ically allows a given memory interface to operate 
with one less wait state than would otherwise be 
required (see 5.4.2 Address Pipelining). The pipe- 
lined bus is also well suited to interleaved memory 
designs. For 16 MHz interleaved memory designs 
with 100 ns access time DRAMs, zero wait states 
can be achieved when pipelined addressing is se- 
lected. When address pipelining is requested by the 
external hardware, the 80386 will output the address 
and bus cycle definition of the next bus cycle (if it is 
internally available) even while waiting for the cur- 
rent cycle to be acknowledged. 


Non-pipelined address timing, however, is ideal for 
external cache designs, since the cache memory will 
typically be fast enough to allow non-pipelined cy- 
cles. For maximum design flexibility, the address 
pipelining option is selectable on a cycle-by-cycle 
basis. 


The processor’s bus cycle is the basic mechanism 
for information transfer, either from system to proc- 
essor, or from processor to system. 80386 bus cy- 
cles perform data transfer in a minimum of only two 
clock periods. On a 32-bit data bus, the maximum 
80386 transfer bandwidth at 16 MHz is therefore 32 
Mbytes/sec. Any bus cycle will be extended for 
more than two clock periods, however, if external 
hardware withholds acknowledgement of the cycle. 
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At the appropriate time, acknowledgement is sig- 
nalled by asserting the 80386 READY # input. 


The 80386 can relinquish control of its local buses 
to allow mastership by other devices, such as direct 
memory access channels. When relinquished, HLDA 
is the only output pin driven by the 80386, providing 
near-complete isolation of the processor from its 
system. The near-complete isolation characteristic is 
ideal when driving the system from test equipment, 
and in fault-tolerant applications. 


Functional data covered in this chapter describes 
the processor’s hardware interface. First, the set of 
signals available at the processor pins is described 
(see 5.2 Signal Description). Following that are the 
signal waveforms occurring during bus cycles (see 
5.3 Bus Transfer Mechanism, 5.4 Bus Functional 
Description and 5.5 Other Functional Descrip- 
tions). 


5.2 SIGNAL DESCRIPTION 


5.2.1 Introduction 


Ahead is a brief description of the 80386 input and 
output signals arranged by functional groups. Note 
the # symbol at the end of a signal name indicates 
the active, or asserted, state occurs when the signal 
is at a low voltage. When no # is present after the 
signal name, the signal is asserted when at the high 
voltage level. 


Example signal: M/IO # — High voltage indicates 
Memory selected 


— Low voltage indicates 
1/0 selected 


The signal descriptions sometimes refer to AC tim- 
ing parameters, such as “tos Reset Setup Time” and 
“tog Reset Hold Time.” The values of these parame- 
ters can be found in Tables 7-4 and 7-5. 


5.2.2 Clock (CLK2) 


CLK2 provides the fundamental timing for the 
80386. It is divided by two internally to generate the 
internal processor clock used for instruction execu- 
tion. The internal clock is comprised of two phases, 
“phase one” and “phase two.” Each CLK2 period is 
a phase of the internal clock. Figure 5-2 illustrates 
the relationship. If desired, the phase of the internal 
processor clock can be synchronized to a known 
phase by ensuring the RESET signal falling edge 
meets its applicable setup and hold times, tos and 


tag. 
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Figure 5-1. Functional Signal Groups 
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Figure 5-2. CLK2 Signal and Internal Processor Clock 


5.2.3 Data Bus (DO through D31) 


These three-state bidirectional signals provide the 
general purpose data path between the 80386 and 
other devices. Data bus inputs and outputs indicate 
“1 when HIGH. The data bus can transfer data on 
32- and 16-bit buses using a data bus sizing feature 
controlled by the BS16# input. See section 5.2.6 
Bus Contol. Data bus reads require that read data 
setup and hold times to; and too be met for correct 
operation. During any write operation (and during 
halt cycles and shutdown cycles), the 80386 always 
drives all 32 signals of the data bus even if the cur- 
rent bus size is 16-bits. 
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5.2.4 Address Bus (BEO# through 
BE3#, A2 through A31) 


These three-state outputs provide physical memory 
addresses or I/O port addresses. The address bus 
is capable of addressing 4 gigabytes of physical 
memory space (O0000000H through FFFFFFFFh), 
and 64 kilobytes of |/O address space (00000000H 
through OOOOFFFFH) for programmed 1/0. |/O 
transfers automatically generated for 80386-to-co- 
processor communication use I/O addresses 
800000F8H through 800000FFH, so A31 HIGH in 
conjunction with M/IO# LOW allows simple genera- 
tion of the coprocessor select signal. 
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The Byte Enable outputs, BEO#-BE3*#, directly in- 
dicate which bytes of the 32-bit data bus are in- 
volved with the current transfer. This is most conve- 
nient for external hardware. 


BEO# applies to DO-D7 
BE1# applies to D8-D15 
BE2# applies to D16-D23 
BE3# applies to D24-D31 


The number of Byte Enables asserted indicates the 
physical size of the operand being transferred (1, 2, 
3, or 4 bytes). Refer to section 5.3.6 Operand Align- 
ment. 


When a memory write cycle or I/O write cycle is in 
progress, and the operand being transferred occu- 
pies only the upper 16 bits of the data bus (D16- 
D31), duplicate data is simultaneously presented on 
the corresponding lower 16-bits of the data bus 
(DO-D15). This duplication is performed for optimum 
write performance on 16-bit buses. The pattern of 
write data duplication is a function of the Byte En- 
ables asserted during the write cycle. Table 5-1 lists 
the write data present on DO-D31, as a function of 
the asserted Byte Enable outputs BEO#-BE3#. 


80386 


ADVANCE INFORMATION 


5.2.5 Bus Cycle Definition Signals 
(W/R#, D/C#, M/IO#, LOCK #) 


These three-state outputs define the type of bus cy- 
cle being performed. W/R# distinguishes between 
write and read cycles. D/C # distinguishes between 
data and control cycles. M/IO# distinguishes be- 
tween memory and |/O cycles. LOCK# distin- 
guishes between locked and unlocked bus cycles. 


The primary bus cycle definition signals are W/R#, 
D/C# and M/IO#, since these are the signals driv- 
en valid as the ADS# (Address Status output) is 
driven asserted. The LOCK# is driven valid at the 
same time as the bus cycle begins, which due to 
address pipelining, could be later than ADS # is driv- 
en asserted. See 5.4.3.4 Pipelined Address. 


Exact bus cycle definitions, as a function of W/R#, 
D/C#, and MI/IO#, are given in Table 5-2. Note 
one combination of W/R#, D/C# and M/IO# is 
never given when ADS # is asserted (however, that 
combination, which is listed as “‘does not occur,” will 
occur during idle bus states when ADS # is not as- 
serted). If M/IO#, D/C#, and W/R# are qualified 
by ADS# asserted, then a decoding scheme may 
use the non-occurring combination to its best advan- 
tage. 


Table 5-1. Write Data Duplication as a Function of BEO # -BE3# 


80386 Byte Enables 80386 Write Data Automatic 
Duplication? 
No 


BE3# BE2# BE1# BEO# | D24-D31 


D = logical write data d24-d31 
C = logical write data d16-d23 
B = logical write data d8-d15 
A = logical write data d0-d7 
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Table 5-2. Bus Cycle Definition 


Bus Cycle Type Locked? 
INTERRUPT ACKNOWLEDGE 


Ow 
Low Low 
Low | High | tow | '/ODATAREAD | No | 
Low ae 
A2-A31 Low) A2-A31 Low) ie 
Low MEMORY DATA READ 


1/0 DATA WRITE 
| Hign | tow | Low | _ MEMORY CODE READ 

MEMORY DATA WRITE 
5.2.6 Bus Control Signals ing sampled, READY must always meet setup and 


HALT: SHUTDOWN: 
Address = 2 Address = 0 

hold times tyg and tao for correct operation. See all 
sections of 5.4 Bus Functional Description. 


(BEO# High (BEO# Low 
BE1# High BE1# High 
BE2# Low BE2# High 
BE3# High BE3# High 


5.2.6.1 INTRODUCTION 


The following signals allow the processor to indicate 5.2.6.4 NEXT ADDRESS REQUEST (NA#) 

when a bus cycle has begun, and allow other system 

hardware to control address pipelining, data bus This is used to request address pipelining. This input 

width and bus cycle termination. indicates the system is prepared to accept new val- 
ues of BEO#-BE3#, A2-A31, W/R#, D/C# and 
M/lO# from the 80386 even if the end of the current 

5.2.6.2 ADDRESS STATUS (ADS#) cycle is not being acknowledged on READY . If this 

input is asserted when sampled, the next address is 

driven onto the bus, provided the next bus request is 

already pending internally. See 5.4.2 Address Pipe- 

lining and 5.4.3 Read and Write Cycles. 


This three-state output indicates that a valid bus cy- 
cle definition, and address (W/R#, D/C#, M/IO#, 
BEO#-BE3#, and A2-A31) is being driven at the 
80386 pins. It is asserted during T1 and T2P bus 
states (see 5.4.3.2 Non-pipelined Address and 
5.4.3.4 Pipelined Address for additional information 5.2.6.5 BUS SIZE 16 (BS16#) 
on bus states). 

The BS16# feature allows the 80386 to directly con- 

nect to 32-bit and 16-bit data buses. Asserting this 
5.2.6.3 TRANSFER ACKNOWLEDGE (READY #) input constrains the current bus cycle to use only the 
lower-order half (D0-D15) of the data bus, corre- 
sponding to BEO# and BE1 #. Asserting BS16# has 
no additional effect if only BEO# and/or BE1# are 
asserted in the current cycle. However, during bus 
cycles asserting BE2# or BE3#, asserting BS16# 
will automatically cause the 80386 to make adjust- 
ments for correct transfer of the upper bytes(s) using 
only physical data signals DO-D15. 


This input indicates the current bus cycle is com- 
plete, and the active bytes indicated by BEO#- 
BE3# and BS16# are accepted or provided. When 
READY # is sampled asserted during a read cycle or 
interrupt acknowledge cycle, the 80386 latches the 
input data and terminates the cycle. When READY # 
is sampled asserted during a write cycle, the proces- 
sor terminates the bus cycle. 


If the operand spans both halves of the data bus 
and BS16# is asserted, the 80386 will automatically 
perform another 16-bit bus cycle. BS16# must al- 
ways meet setup and hold times t;7 and t;g for cor- 
rect operation. 


READY # is ignored on the first bus state of all bus 
cycles, and sampled each bus state thereafter until 
asserted. READY # must eventually be asserted to 
acknowledge every bus cycle, including Halt Indica- 
tion and Shutdown Indication bus cycles. When be- 
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80386 |/O cycles automatically generated for co- 
processor communication do not require BS16# be 
asserted. The coprocessor type, 80287 or 80387, is 
sensed on the ERROR # input shortly after the fall- 
ing edge of RESET. The 80386 transfers only 16-bit 
quantities between itself and the 80287, but must 
transfer 32-bit quantities between itself and the 
80387. Therefore BS16# is a don’t care during 
80287 cycles and must not be asserted during 
80387 communication cycles. 


5.2.7 Bus Arbitration Signals 


5.2.7.1 INTRODUCTION 


This section describes the mechanism by which the 
processor relinquishes control of its local buses 
when requested by another bus master device. See 
5.5.1 Entering and Exiting Hold Acknowledge for 
additional information. 


5.2.7.2 BUS HOLD REQUEST (HOLD) 


This input indicates some device other than the 
80386 requires bus mastership. 


HOLD must remain asserted as long as any other 
device is a local bus master. HOLD is not recognized 
while RESET is asserted. If RESET is asserted while 
HOLD is asserted, RESET has priority and places 
the bus into an idle state, rather than the hold ac- 
knowledge (high impedance) state. 


HOLD is level-sensitive and is a synchronous input. 
HOLD signals must always meet setup and hold 
times tog and to4 for correct operation. 


5.2.7.3 BUS HOLD ACKNOWLEDGE (HLDA) 


Assertion of this output indicates the 80386 has re- 
linquished control of its local bus in response to 
HOLD asserted, and is in the bus Hold Acknowledge 
state. 


The Hold Acknowledge state offers near-complete 
signal isolation. In the Hold Acknowledge state, 
HLDA is the only signal being driven by the 80386. 
The other output signals or bidirectional signals 
(DO-D31, BEO#-BE3#, A2-A31, W/R#, D/C#, 
M/lIO#, LOCK# and ADS#) are in a high-imped- 
ance state so the requesting bus master may control 
them. Pullup resistors may be desired on several sig- 
nals to avoid spurious activity when no bus master is 
driving them. See 7.2.3 Resistor Recommenda- 
tions. Also, one rising edge occuring on the NMI 
input during Hold Acknowledge is remembered, for 
processing after the HOLD input is negated. 
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In addition to the normal usage of Hold Acknowl- 
edge with DMA controllers or master peripherals, 
the near-complete isolation has particular attractive- 
ness during system test when test equipment drives 
the system, and in hardware-fault-tolerant applica- 
tions. 


5.2.8 Coprocessor Interface Signals 


5.2.8.1 INTRODUCTION 


In the following sections are descriptions of signals 
dedicated to the numeric coprocessor interface. In 
addition to the data bus, address bus, and bus cycle 
definition signals, these following signals control 
communication between the 80386 and its 80287 or 
80387 processor extension. 


5.2.8.2 COPROCESSOR REQUEST (PEREQ) 


When asserted, this input signal indicates a coproc- 
essor request for a data operand to be transferred 
to/from memory by the 80386. In response, the 
80386 transfers information between the coproces- 
sor and memory. Because the 80386 has internally 
stored the coprocessor opcode being executed, it 
performs the requested data transfer with the cor- 
rect direction and memory address. 


PEREQ is level-sensitive and is allowed to be asyn- 
chronous to the CLK2 signal. 


5.2.8.3 COPROCESSOR BUSY (BUSY #) 


When asserted, this input indicates the coprocessor 
is still executing an instruction, and is not yet able to 
accept another. When the 80386 encounters any 
coprocessor instruction which operates on the nu- 
meric stack (e.g. load, pop, or arithmetic operation), 
or the WAIT instruction, this input is first automatical- 
ly sampled until it is seen to be negated. This sam- 
pling of the BUSY # input prevents overrunning the 
execution of a previous coprocessor instruction. 


The FNINIT and FNCLEX coprocessor instructions 
are allowed to execute even if BUSY # is asserted, 
since these instructions are used for coprocessor 
initialization and exception-clearing. 


BUSY # is level-sensitive and is allowed to be asyn- 
chronous to the CLK2 signal. 


BUSY # serves an additional function. If BUSY # is 
sampled LOW at the falling edge of RESET, the 
80386 performs an internal self-test (see 5.5.3 Bus 
Activity During and Following Reset). If BUSY # is 
sampled HIGH, no self-test is performed. 
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5.2.8.4 COPROCESSOR ERROR (ERROR #) 


This input signal indicates that the previous coproc- 
essor instruction generated a coprocessor error of a 
type not masked by the coprocessor’s control regis- 
ter. This input is automatically sampled by the 80386 
when a coprocessor instruction is encountered, and 
if asserted, the 80386 generates exception 7 to ac- 
cess the error-handling software. 


Several coprocessor instructions, generally those 
which clear the numeric error flags in the coproces- 
sor or save coprocessor state, do execute without 
the 80386 generating exception 7 even if ERROR# 
is asserted. These instructions are FNINIT, 
FNCLEX, FSTSW, FSTSWAX, FSTCW, FSTENV, 
FSAVE, FESTENV and FESAVE. 


ERROR # is level-sensitive and is allowed to be 
asynchronous to the CLK2 signal. 


ERROR # serves an additional function. If ERROR # 
is LOW no later than 20 CLK2 periods after the fall- 
ing edge of RESET and remains LOW at least until 
the 80386 begins its first bus cycle, an 80387 is as- 
sumed to be present (ET bit in CRO automatically 
gets set to 1). Otherwise, an 80287 (or no coproces- 
sor) is assumed to be present (ET bit in CRO auto- 
matically is reset to 0). See 5.5.3 Bus Activity Dur- 
ing and After Reset. Only the ET bit is set by this 
ERROR # pin test. Software must set the EM and 
MP bits in CRO as needed. Therefore, distinguishing 
80287 presence from no coprocessor requires a 
software test and appropriately resetting or setting 
the EM bit of CRO (set EM = 1 when no coproces- 
sor is present). If ERROR# is sampled LOW after 
reset (indicating 80387) but software later sets 
EM = 1, the 80386 will behave as if no coprocessor 
is present. 


5.2.9 Interrupt Signals 


5.2.9.1 INTRODUCTION 


The following descriptions cover inputs that can in- 
terrupt or suspend execution of the processor’s cur- 
rent instruction stream. 


5.2.9.2 MASKABLE INTERRUPT REQUEST (INTR) 


When asserted, this input indicates a request for in- 
terrupt service, which can be masked by the 80386 
Flag Register IF bit. When the 80386 responds to 
the INTR input, it performs two interrupt acknowl- 
edge bus cycles, and at the end of the second, 
latches an 8-bit interrupt vector on DO-D7 to identify 
the source of the interrupt. 


INTR is level-sensitive and is allowed to be asyn- 
chronous to the CLK2 signal. To assure recognition 


of an INTR request, INTR should remain asserted 
until the first interrupt acknowledge bus cycle be- 
gins. 


5.2.9.3 NON-MASKABLE INTERRUPT REQUEST 
(NMI) 


This input indicates a request for interrupt service, 
which cannot be masked by software. The non- 
maskable interrupt request is always processed ac- 
cording to the pointer or gate in slot 2 of the interrupt 
table. Because of the fixed NMI slot assignment, no 
interrupt acknowledge cycles are perfomed when 
processing NMI. 


NMI is rising edge-sensitive and is allowed to be 
asynchronous to the CLK2 signal. To assure recog- 
nition of NMI, it must be negated for at least eight 
CLK2 periods, and then be asserted for at least 
eight CLK2 periods. 


Once NMI processing has begun, no additional 
NMI’s are processed until after the next IRET in- 
struction, which is typically the end of the NMI serv- 
ice routine. If NMI is re-asserted prior to that time, 
however, one rising edge on NMI will be remem- 
bered for processing after executing the next IRET 
instruction. 


5.2.9.4 RESET (RESET) 


This input signal suspends any operation in progress 
and places the 80386 in a known reset state. The 
80386 is reset by asserting RESET for 15 or more 
CLK2 periods (78 or more CLK2 periods before re- 
questing self test). When RESET is asserted, all oth- 
er input pins are ignored, and all other bus pins are 
driven to an idle bus state as shown in Table 5-3. If 
RESET and HOLD are both asserted at a point in 
time, RESET takes priority even if the 80386 was in 
a Hold Acknowledge state prior to RESET asserted. 


RESET is level-sensitive and is allowed to be asyn- 
chronous to the CLK2 signal. If desired, the phase of 
the internal processor clock, and the entire 80386 
state can be completely synchronized to external 
circuitry by ensuring the RESET signal falling edge 
meets its applicable setup and hold times, tos and 
tog. 
Table 5-3. Pin State (Bus Idle) During Reset 


| PinName | Signal Level During Reset 


ADS# High 
DO-D31 High Impedance 
BEO#-BE3# Low 
A2-A31 High 


W/R# High 
D/C# High 
M/IO# Low 
LOCK # High 
HLDA Low 


5.2.10 Signal Summary 
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Table 5-4 summarizes the characteristics of all 80386 signals. 
Table 5-4. 80386 Signal Summary 


Input/ 
Output 


Signal Function 


Signal Name 


rpo-0e1 | Oatasis CS 


RESET Reset 


NOTE: 


Active 
State 


Input 
Synch or 
Asynch 


Output 
High Impedance 
During HLDA? 


If the phase of the internal processor clock must be synchronized to external circuitry, RESET falling edge must meet setup 


and hold times tas and tag. 


5.3 BUS TRANSFER MECHANISM 


5.3.1 Introduction 


All data transfers occur as a result of one or more 
bus cycles. Logical data operands of byte, word and 
double-word lengths may be transferred without re- 
strictions on physical address alignment. Any byte 
boundary may be used, although two or even three 
physical bus cycles are performed as required for 
unaligned operand transfers. See 5.3.4 Dynamic 
Data Bus Sizing and 5.3.6 Operand Alignment. 
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The 80386 address signals are designed to simplify 
external system hardware. Higher-order address bits 
are provided by A2—A31. Lower-order address in the 
form of BEO#-BE3¥# directly provides linear selects 
for the four bytes of the 32-bit data bus. Physical 
operand size information is thereby implicitly provid- 
ed each bus cycle in the most usable form. 


Byte Enable outputs BEO#-BE3# are asserted 
when their associated data bus bytes are involved 
with the present bus cycle, as listed in Table 5-5. 
During a bus cycle, any possible pattern of contigu- 
ous, asserted Byte Enable outputs can occur, but 
never patterns having a negated Byte Enable sepa- 
rating two or three asserted Enables. 
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Address bits AO and A1 of the physical operand’s 
base address can be created when necessary (for 
instance, for Multibus | or Multibus I! interface), as a 
function of the lowest-order asserted Byte Enable. 
This is shown by Table 5-6. Logic to generate AO 
and A1 is given by Figure 5-3. 


Table 5-5. Byte Enables and Associated 
Data and Operand Bytes 


F_aeo# [00-7 tte teas sgifcan | 
Peete [oe-o18 ee) 
Pecze[ore-025 one) 
[263+ [oet-081 toe nos sian | 


BE1# 
K - Map for A1 Signal 


BEO¥ 


K - Map for AO Signal 


Figure 5-3. Logic to Generate AO, A1 from BEO# -BE3# 


Each bus cycle is composed of at least two bus 
states. Each bus state requires one processor clock 
period. Additional bus states added to a single bus 
cycle are called wait states. See 5.4 Bus Functional 
Description. 


Since a bus cycle requires a minimum of two bus 
states (equal to two processor clock periods), data 
can be transferred between external devices and 
the 80386 at a maximum rate of one 4-byte Dword 
every two processor clock periods, for a maximum 
bus bandwidth of 32 megabytes/second (80386-16 
operating at 16 MHz processor clock rate). 


80386 
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Table 5-6. Generating AO-A31 from 
BEO #-BE3# and A2-A31 


80386 Address Signals 
BE3 # | BE2# | BE1#| BEO# 


231630-3 


231630-4 


5.3.2 Memory and I/O Spaces 


Bus cycles may access physical memory space or 
\/O space. Peripheral devices in the system may ei- 
ther be memory-mapped, or |/O-mapped, or both. 
As shown in Figure 5-4, physical memory addresses 
range from OOO000000H to FFFFFFFFH (4 gigabytes) 
and |/O addresses from O00000000H to OOOOFFFFH 
(64 kilobytes) for programmed I/O. Note the I/O ad- 
dresses used by the automatic !/O cycles for co- 
Processor communication are 800000F8H to 
800000FFH, beyond the address range of pro- 
grammed |/O, to allow easy generation of a coproc- 
essor chip select signal using the A31 and M/IO# 
signals. 


FFFFFFFFH 


PHYSICAL 
MEMORY 


4GBYTE 


00000000H 
Physical Memory Space 
NOTE: 
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800000FFH 
800000F8H 
(NOTE 1) 


00000000H 
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' +ACCESSIBLES 
Y 


=}  corrocessor 
; 


(80387 OR 80287) 


sACCESSIBLEt 


Oy 


OOOOFFFFH » 


[ser] 


\/O Space 


ACCESSIBLE 
PROGRAMMED 
1/0 SPACE 


Since A31 is HIGH during automatic communication with coprocessor, A31 HIGH and M/IO# LOW can be used to 


easily generate a coprocessor select signal. 


Figure 5-4. Physical Memory and I/O Spaces 


5.3.3 Memory and I/O Organization 


The 80386 datapath to memory and |/O spaces can 
be 32 bits wide or 16 bits wide. When 32-bits wide, 
memory and I/O spaces are organized naturally as 
arrays of physical 32-bit Dwords. Each memory or 
|/O Dword has four individually addressable bytes at 
consecutive byte addresses. The lowest-addressed 
byte is associated with data signals DO-D7; the 
highest-addressed byte with D24-D31. 


The 80386 includes a bus control input, BS16#, that 
also allows direct connection to 16-bit memory or 
1/O spaces organized as a sequence of 16-bit 
words. Cycles to 32-bit and 16-bit memory or I/O 
devices may occur in any sequence, since the 
BS16# control is sampled during each bus cycle. 
See 5.3.4 Dynamic Data Bus Sizing. The Byte En- 
able signals, BEO#-BE3#, allow byte granularity 
when addressing any memory or |/O structure, 
whether 32 or 16 bits wide. 


5.3.4 Dynamic Data Bus Sizing 


Dynamic data bus sizing is a feature allowing direct 
Processor connection to 32-bit or 16-bit data buses 
for memory or I/O. A single processor may connect 
to both size buses. Transfers to or from 32- or 16-bit 
ports are supported by dynamically determining the 
bus width during each bus cycle. During each bus 
cycle an address decoding circuit or the slave de- 
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vice itself may assert BS16# for 16-bit ports, or ne- 
gate BS16# for 32-bit ports. 


With BS16# asserted, the processor automatically 
converts operand transfers larger than 16 bits, or 
misaligned 16-bit transfers, into two or three trans- 
fers as required. All operand transfers physically oc- 
cur on DO-D15 when BS16# is asserted. There- 
fore, 16-bit memories or |/O devices only connect 
on data signals DO-D15. No extra transceivers are 
required. 


Asserting BS16# only affects the processor when 
BE2# and/or BE3# are asserted during the current 
cycle. If only DO-D15 are involved with the transfer, 
asserting BS16# has no affect since the transfer 
can proceed normally over a 16-bit bus whether 
BS16# is asserted or not. In other words, asserting 
BS16# has no effect when only the lower half of the 
bus is involved with the current cycle. 


There are two types of situations where the proces- 
sor is affected by asserting BS16#, depending on 
which Byte Enables are asserted during the current 
bus cycle: 


Upper Half Only: 
Only BE2# and/or BES# asserted. 


Upper and Lower Half: 
At least BE1#, BE2# asserted (and perhaps 
also BEO# and/or BE3#). 
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Effect of asserting BS16# during “upper half only” 

read cycles: 
Asserting BS16# during “upper half only” reads 
causes the 80386 to read data on the lower 16 
bits of the data bus and ignore data on the upper 
16 bits of the data bus. Data that would have been 
read from D16-D31 (as indicated by BE2# and 
BE3#) will instead be read from DO-D15 respec- 
tively. 


Effect of asserting BS16# during ‘upper half only” 

write cycles: 
Asserting BS16# during “upper half only” writes 
does not affect the 80386. When only BE2# 
and/or BE3# are asserted during a write cycle 
the 80386 always duplicates data _ signals 
D16-D31 onto DO-D15 (see Table 5-1). There- 
fore, no further 80386 action is required to per- 
form these writes on 32-bit or 16-bit buses. 


Effect of asserting BS16# during “upper and lower 

half” read cycles: 
Asserting BS16# during “upper and lower half’ 
reads causes the processor to perform two 16-bit 
read cycles for complete physical operand trans- 
fer. Bytes 0 and 1 (as indicated by BEO# and 
BE1 #) are read on the first cycle using DO-D15. 
Bytes 2 and 3 (as indicated by BE2# and BE3#) 
are read during the second cycle, again using 
DO-D15. D16-D31 are ignored during both 16-bit 
cycles. BEO# and BE1# are always negated dur- 
ing the second 16-bit cycle. BS16# does not have 
to be asserted during the second 16-bit cycle. See 
Figure 5-14, cycles 2 and 2a. 
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Effect of asserting BS16# during “upper and lower 

half” write cycles: 
Asserting BS16# during “upper and lower half” 
writes causes the 80386 to perform two 16-bit 
write cycles for complete physical operand trans- 
fer. All bytes are available the first write cycle al- 
lowing external hardware to receive Bytes 0 and 1 
(as indicated by BEO# and BE1 #) using DO-D15. 
On the second cycle the 80386 duplicates Bytes 2 
and 3 on DO-D15 and Bytes 2 and 3 (as indicated 
by BE2# and BE3#) are written using DO-D15. 
BEO# and BE1# are always negated during the 
second 16-bit cycle. BS16# does not have to be 
asserted during the second 16-bit cycle. See 
Figure 5-14, cycles 1 and 1a. 


5.3.5 Interfacing with 32- and 16-Bit 
Memories 


In 32-bit-wide physical memories such as Figure 5-5, 
each physical Dword begins at a byte address that is 
a multiple of 4. A2-A31 are directly used as a Dword 
select and BEO#-BE3# as byte selects. BS16# is 
negated for all bus cycles involving the 32-bit array. 


When 16-bit-wide physical arrays are included in the 
system, as in Figure 5-6, each 16-bit physical word 
begins at a address that is a multiple of 2. Note the 
address is decoded, to assert BS16# only during 
bus cycles involving the 16-bit array. (If desiring to use 


32, DATA BUS (D0-D31) 


32=BIT 
80386 | snpRESS BUS (BEO#-BE3#,A2—A31) _ | MEMORY 
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Figure 5-5. 80386 with 32-Bit Memory 
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32=BiT 
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ADDRESS BUS (A2~A31) 
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Figure 5-6. 80386 with 32-Bit and 16-Bit Memory 
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pipelined address with 16-bit memories then BEO #- 
BE3# and W/R# are also decoded to determine 
when BS16# should be asserted. See 5.4.3.7 Maxi- 
mum Pipelined Address Usage with 16-Bit Bus 
Size.) 


A2-A31 are directly usable for addressing 32-bit 
and 16-bit devices. To address 16-bit devices, A1 
and two byte enable signals are also needed. 


To generate an A1 signal and two Byte Enable sig- 
nals for 16-bit access, BEO#-BE3# should be de- 
coded as in Table 5-7. Note certain combinations of 
BEO#-BE3# are never generated by the 80386, 
leading to “don’t care” conditions in the decoder. 
Any BEO#-BE3# decoder, such as Figure 5-7, may 
use the non-occurring BEO#-BE3# combinations 
to its best advantage. 


5.3.6 Operand Alignment 


With the flexibility of memory addressing on the 
80386, it is possible to transfer a logical operand 
that spans more than one physical Dword or word of 
memory or |/O. Examples are 32-bit Dword oper- 
ands beginning at addresses not evenly divisible by 
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4, or a 16-bit word operand split between two physi- 
cal Dwords of the memory array. 


Operand alignment and data bus size dictate when 
multiple bus cycles are required. Table 5-8 describes 
the transfer cycles generated for all combinations of 
logical operand lengths, alignment, and data bus siz- 
ing. When multiple bus cycles are required to trans- 
fer a multi-byte logical operand, the highest-order 
bytes are transferred first (but if BS16# asserted 
requires two 16-bit cycles be performed, that part of 
the transfer is low-order first). 


5.4 BUS FUNCTIONAL DESCRIPTION 


5.4.1 Introduction 


The 80386 has separate, parallel buses for data and 
address. The data bus is 32-bits in width, and bidi- 
rectional. The address bus provides a 32-bit value 
using 30 signals for the 30 upper-order address bits 
and 4 Byte Enable signals to directly indicate the 
active bytes. These buses are interpreted and con- 
trolled via several associated definition or control 
signals. 


Table 5-7. Generating A1, BHE # and BLE # for Addressing 16-Bit Devices 


80386 Signals 16-Bit Bus Signals Comments 


* 
* 
* 


| Bes+ | Be2+ | Be1# | BEo* | A1 | BHE# | BLE# (AO) | 
H* x 


ITrreer ness 
Srrrsrrtzs 
SreSesraIrs 


x 
L 
L 
L 
H 
x 
L 
L 
H 
x 
x 
x 
H 
x 
L 
L 


BLE # asserted when DO-D7 of 16-bit bus is active. 


BHE # asserted when D8-D15 of 16-bit bus is active. 


A1 low for all even words; A1 high for all odd words. 


Key: 
x = don’tcare 
= high voltage level 
L = low voltage level 


x—no active bytes 


x—not contiguous bytes 


x—not contiguous bytes 
x—not contiguous bytes 
x—not contiguous bytes 


x—not continguous bytes 


FPesxe rex xe rrrxitrere zs 
cee OR a a = pet a ee ON 


* = anon-occurring pattern of Byte Enables; either none are asserted, 
or the pattern has Byte Enables asserted for non-contiguous bytes 
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K-map for A1 signal (same as Figure 5-3) 
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BE1# 
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K-map for 16-bit BHE # signal 


BEO¥ 


231630-10 


K-map for 16-bit BLE # signal (same as AO signal in Figure 5-3) 


Figure 5-7. Logic to Generate A1, BHE # and BLE # for 16-Bit Buses 


Table 5-8. Transfer Bus Cycles for Bytes, Words and Dwords 


Physical Byte Address 
in Memory (low-order bits) 


Transfer Cycles over 
32-Bit Data Bus 


Transfer Cycles over 
16-Bit Data Bus 


Byte-Length of Logical Operand 


= byte transfer 
word transfer d = Dword transfer 
low-order portion h = high-order portion 
mid-order portion 
don’t care 

= BS16# asserted causes second bus cycle 
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The definition of each bus cycle is given by three 
definition signals: M/IO#, W/R# and D/C#. At the 
same time, a valid address is present on the byte 
enable signals BEO #-BE3# and other address sig- 
nals A2-A31. A status signal, ADS#, indicates 
when the 80386 issues a new bus cycle definition 
and address. 


Collectively, the address bus, data bus and all asso- 
ciated control signals are referred to simply as ‘‘the 


When active, the bus performs one of the bus cycles 
below: 


1) read from memory space 

2) locked read from memory space 

3) write to memory space 

4) locked write to memory space 

5) read from |/O space (or coprocessor) 
6) write to |/O space (or coprocessor) 
7) interrupt acknowledge 

8) indicate halt, or indicate shutdown 


CYCLE 1 


NON=PIPELINED 


(INPUT) 


BEO#=BE3#,A2-A31, 
M/lO#, D/C#, W/R# 
(OUTPUTS) 


ADS# L 


(OUTPUT) 


NA# [ 


(INPUT) 


READY# 
(INPUT) 


LOCK 
(OUTPUT) 


DO=D31 
(INPUT DURING READ) 


Fastest non-pipelined bus cycles consist of T1 and T2 
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Table 5-1 shows the encoding of the bus cycle defi- 
nition signals for each bus cycle. See section 5.2.5 
Bus Cycle Definition. 


The data bus has a dynamic sizing feature support- 
ing 32- and 16-bit bus size. Data bus size is indicated 
to the 80386 using its Bus Size 16 (BS16 #) input. All 
bus functions can be performed with either data bus 
size. 


When the 80386 bus is not performing one of the 
activities listed above, it is either Idle or in the Hold 
Acknowledge state, which may be detected by ex- 
ternal circuitry. The idle state can be identified by the 
80386 giving no further assertions on its address 
strobe output (ADS#) since the beginning of its 
most recent bus cycle, and the most recent bus cy- 
cle has been terminated. The hold acknowledge 
state is identified by the 80386 asserting its hold ac- 
knowledge (HLDA) output. 


The shortest time unit of bus activity is a bus state. A 
bus state is one processor clock period (two CLK2 
periods) in duration. A complete data transfer occurs 
during a bus cycle, composed of two or more bus 
states. 


CYCLE 2 
NON=PIPELINED 


CYCLE 3 
NON=PIPELINED 


231630-11 


Figure 5-8. Fastest Read Cycles with Non-Pipelined Address Timing 
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The fastest 80386 bus cycle requires only two bus 
states. For example, three consecutive bus read cy- 
cles, each consisting of two bus states, are shown 
by Figure 5-8. The bus states in each cycle are 
named T1 and T2. Any memory or I/O address may 
be accessed by such a two-state bus cycle, if the 
external hardware is fast enough. The high-band- 
width, two-clock bus cycle realizes the full potential 
of fast main memory, or cache memory. 


Every bus cycle continues until it is acknowledged 
by the external system hardware, using the 80386 
READY # input. Acknowledging the bus cycle at the 
end of the first T2 results in the shortest bus cycle, 
requiring only T1 and T2. If READY # is not immedi- 
ately asserted however, T2 states are repeated in- 
definitely until the READY # input is sampled assert- 
ed. 


5.4.2 Address Pipelining 


The address pipelining option provides a choice of 
bus cycle timings. Pipelined or non-pipelined ad- 
dress timing is selectable on a cycle-by-cycle basis 
with the Next Address (NA#) input. 


CYCLE 1 
PIPELINED 
(READ) 


TIP T2P 


CLK2 
(INPUT) 


BEO#=BE3#, A2-A31, 
M/lO#, D/C#, W/R# 
(OUTPUTS) 


ano 


ADS# 
(OUTPUT) 


NA# 
(INPUT) 


READY# 
(INPUT) 


LOCK# 
(OUTPUT) 


DO=-D31 
(INPUT DURING READ) 
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When address pipelining is not selected, the current 
address and bus cycle definition remain stable 
throughout the bus cycle. 


When address pipelining is selected, the address 
(BEO#-BE3#, A2-A31) and definition (W/R#, 
D/C# and M/IO#) of the next cycle are available 
before the end of the current cycle. To signal their 
availability, the 80386 address status output (ADS #) 
is also asserted. Figure 5-9 illustrates the fastest 
read cycles with pipelined address timing. 


Note from Figure 5-9 the fastest bus cycles using 
pipelined address require only two bus states, 
named T1P and T2P. Therefore cycles with pipe- 
lined address timing allow the same data bandwidth 
as non-pipelined cycles, but address-to-data access 
time is increased compared to that of a non-pipe- 
lined cycle. 


By increasing the address-to-data access time, pipe- 
lined address timing reduces wait state require- 
ments. For example, if one wait state is required with 
non-pipelined address timing, no wait states would 
be required with pipelined address. 


CYCLE 2 
PIPELINED 
(READ) 


TIP T2P 


CYCLE 3 
PIPELINED 
(READ) 


VJ Y, 
XX _ VALID 3 » 
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Fastest pipelined bus cycles consist of T1P and T2P 


Figure 5-9. Fastest Read Cycles with Pipelined Address Timing 
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Pipelined address timing is useful in typical systems 
having address latches. In those systems, once an 
address has been latched, pipelined availability of 
the next address allows decoding circuitry to gener- 
ate chip selects (and other necessary select signals) 
in advance, so selected devices are accessed im- 
mediately when the next cycle begins. In other 
words, the decode time for the next cycle can be 
overlapped with the end of the current cycle. 


If a system contains a memory structure of two or 
more interleaved memory banks, pipelined address 
timing potentially allows even more overlap of activi- 
ty. This is true when the interleaved memory control- 
ler is designed to allow the next memory operation 


TWO-BANK INTERLEAVED MEMORY 
a) Address signal A2 selects bank 
b) 32-bit datapath to each bank 


DATA BUS 
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INTERLEAVE ami 
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b) 32-bit datapath to each bank 
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to begin in one memory bank while the current bus 
cycle is still activating another memory bank. Figure 
5-10 shows the general structure of the 80386 with 
2-bank and 4-bank interleaved memory. Note each 
memory bank of the interleaved memory has full 
data bus width (32-bit data width typically, unless 16- 
bit bus size is selected). 


Further details of pipelined address timing are given 
in 5.4.3.4 Pipelined Address, 5.4.3.5 Initiating and 
Maintaining Pipelined Address, 5.4.3.6 Pipetined 
Address with Dynamic Bus Siziing, and 5.4.3.7 
Maximum Pipelined Address Usage with 16-Bit 
Bus Size. 
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Figure 5-10. 2-Bank and 4-Bank Interleaved Memory Structure 
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5.4.3 Read and Write Cycles 


5.4.3.1 INTRODUCTION 


Data transfers occur as a result of bus cycles, classi- 
fied as read or write cycles. During read cycles, data 
is transferred from an external device to the proces- 
sor. During write cycles data is transferred in the oth- 
er direction, from the processor to an external de- 
vice. 


Two choices of address timing are dynamically se- 
lectable: non-pipelined, or pipelined. After a bus idle 
state, the processor always uses non-pipelined ad- 
dress timing. However, the NA# (Next Address) in- 
put may be asserted to select pipelined address tim- 
ing for the next bus cycle. When pipelining is select- 
ed and the 80386 has a bus request pending inter- 
nally, the address and definition of the next cycle is 
made available even before the current bus cycle is 
acknowledged by READY #. Generally, the NA# in- 
put is sampled each bus cycle to select the desired 
address timing for the next bus cycle. 


IDLE CYCLE 1 
NON=PIPELINED 
(WRITE) 

11 


12 11 


CLK2 [ 


(82384 CLK) [ 


[ 


BEO #—BES # 
A2-A31, 


M/l0 #, D/C # 


XKXXD 


wane 


XXX KXX KAKA XK ties XXX Bes 


32=BIT 
BUS | (si BEe] 


XXX i XXX 


ami ar! 


ae Soe 


LEP 1 


80386 


CYCLE 2 
NON=PIPELINED 
(READ) 


12 


i Sac 
BUS Se 


ADVANCE INFORMATION 


Two choices of physical data bus width are dynami- 
cally selectable: 32 bits, or 16 bits. Generally, the 
BS16# (Bus Size 16) input is sampled near the end 
of the bus cycle to confirm the physical data bus size 
applicable to the current cycle. Negation of BS16# 
indicates a 32-bit size, and assertion indicates a 16- 
bit bus size. 


If 16-bit bus size is indicated, the 80386 automatical- 
ly responds as required to complete the transfer on 
a 16-bit data bus. Depending on the size and align- 
ment of the operand, another 16-bit bus cycle may 
be required. Table 5-7 provides all details. When 
necessary, the 80386 performs an additional 16-bit 
bus cycle, using DO-D15 in place of D16-D31. 


Terminating a read cycle or write cycle, like any bus 
cycle, requires acknowledging the cycle by asserting 
the READY # input. Until acknowledged, the proces- 
sor inserts wait states into the bus cycle, to allow 
adjustment for the speed of any external device. Ex- 
ternal hardware, which has decoded the address 
and bus cycle type asserts the READY # input at the 
appropriate time. 
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Figure 5-11. Bus Cycles with Non-Pipelined Address (zero wait states) 
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At the end of the second bus state within the bus 
cycle, READY # is sampled. At that time, if external 
hardware acknowledges the bus cycle by asserting 
READY #, the bus cycle terminates as shown in Fig- 
ure 5-11. If READY # is negated as in Figure 5-12, 
the cycle continues another bus state (a wait state) 
and READY # is sampled again at the end of that 
state. This continues indefinitely until the cycle is ac- 
knowledged by READY # asserted. 


When the current cycle is acknowledged, the 80386 
terminates it. When a read cycle is acknowledged, 
the 80386 latches the information present at its data 
pins. When a write cycle is acknowledged, the 
80386 write data remains valid throughout phase 
one of the next bus state, to provide write data hold 
time. 


5.4.3.2 NON-PIPELINED ADDRESS 


Any bus cycle may be performed with non-pipelined 
address timing. For example, Figure 5-11 shows a 
mixture of read and write cycles with non-pipelined 
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address timing. Figure 5-11 shows the fastest possi- 
ble cycles with non-pipelined address have two bus 
states per bus cycle. The states are named T1 and 
T2. In phase one of the T1, the address signals and 
bus cycle definition signals are driven valid, and to 
signal their availability, address strobe (ADS#) is 
simultaneously asserted. 


During read or write cycles, the data bus behaves as 
follows. If the cycle is a read, the 80386 floats its 
data signals to allow driving by the external device 
being addressed. If the cycle is a write, data signals 
are driven by the 80386 beginning in phase two of 
T1 until phase one of the bus state following cycle 
acknowledgment. 


Figure 5-12 illustrates non-pipelined bus cycles with 
one wait added to cycles 2 and 3. READY # is sam- 
pled negated at the end of the first T2 in cycles 2 
and 3. Therefore cycles 2 and 3 have T2 repeated. 
At the end of the second T2, READY # is sampled 
asserted. 
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Figure 5-12. Bus Cycles with Non-Pipelined Address (various number of wait states) 
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Ti—first clock of a non-pipelined bus cycle (80386 drives new address and asserts ADS #) 
T2—subsequent clocks of a bus cycle when NA# has not been sampled asserted in the current bus cycle 


Ti— idle state 
Th—hold acknowledge state (80386 asserts HLDA) 
The fastest bus cycle consists of two states: T1 and T2. 


Four basic bus states describe bus operation when not using pipelined address. These states do include BS16# usage for 32-bit and 16-bit 
bus size. If asserting BS16# requires a second 16-bit bus cycle to be performed, it is performed before HOLD asserted is acknowledged. 


Figure 5-13. 80386 Bus States (not using pipelined address) 


When address pipelining is not used, the address 
and bus cycle definition remain valid during all wait 
states. When wait states are added and you desire 
to maintain non-pipelined address timing, it is neces- 
sary to negate NA# during each T2 state except the 
last one, as shown in Figure 5-12 cycles 2 and 3. If 
NA# is sampled asserted during a T2 other than the 
last one, the next state would be T2I (for pipelined 
address) or T2P (for pipelined address) instead of 
another T2 (for non-pipelined address). 


When address pipelining is not used, the bus states 
and transitions are completely illustrated by Figure 
5-13. The bus transitions between four possible 
states: T1, T2, Ti, and Th. Bus cycles consist of T1 
and T2, with T2 being repeated for wait states. Oth- 
erwise, the bus may be idle, in the Ti state, or in hold 
acknowledge, the Th state. 


When address pipelining is not used, the bus state 
diagram is as shown in Figure 5-13. When the bus is 
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idle it is in state Ti. Bus cycles always begin with T1. 
T1 always leads to T2. If a bus cycle is not acknowl- 
edged during T2 and NA# is negated, T2 is repeat- 
ed. When a cycle is acknowledged during T2, the 
following state will be T1 of the next bus cycle if a 
bus request is pending internally, or Ti if there is no 
bus request pending, or Th if the HOLD input is be- 
ing asserted. 


The bus state diagram in Figure 5-13 also applies to 
the use of BS16#. If the 80386 makes internal ad- 
justments for 16-bit bus size, the adjustments do not 
affect the external bus states. If an additional 16-bit 
bus cycle is required to complete a transfer on a 16- 
bit bus, it also follows the state transitions shown in 
Figure 5-13. 


Use of pipelined address allows the 80386 to enter 
three additional bus states not shown in Figure 5-13. 
Figure 5-20 in 5.4.3.4 Pipelined Address is the 
complete bus state diagram, including pipelined ad- 
dress cycles. 
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5.4.3.3 NON-PIPELINED ADDRESS WITH 
DYNAMIC DATA BUS SIZING 


The physical data bus width for any non-pipelined 
bus cycle can be either 32-bits or 16-bits. At the 
beginning of the bus cycle, the processor behaves 
as if the data bus is 32-bits wide. When the bus cy- 
cle is acknowledged, by asserting READY # at the 
end of a T2 state, the most recent sampling of 
BS16# determines the data bus size for the cycle 
being acknowledged. If BS16# was most recently 
negated, the physical data bus size is defined as 
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32 bits. If BS16# was most recently asserted, the 
size is defined as 16 bits. 


When BS16# is asserted and two 16-bit bus cycles 
are required to complete the transfer, BS16# does 
have to be asserted during the second cycle; 16-bit 
bus size is not assumed. Like any bus cycle, the 
second 16-bit cycle must be acknowledged by as- 
serting READY #. 


When a second 16-bit bus cycle is required to com- 
plete the transfer over a 16-bit bus, the addresses 
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Figure 5-14. Asserting BS16 # (zero wait states, non-pipelined address) 


73 


80386 


ADVANGE INFORMATION 


A TRANSFER REQUIRING TWO 
CYCLES ON 16—BIT DATA BUS 


CYCLE 1 
NON=PIPELINED 
(READ 
PART ONE 


T2 


CLK2 


L 
[ XXXXYX) 
[ 


[XXX 


eT —\_Y— 


(82384 CLK) 


BEO #, BEI # 
BE2 #, BES # 
A2=A31, 
M/IO #, D/C # 


W/R # 


[ XXXKXXXXXXXD 


READY # 


L XXXXXXXXKXY 


LOCK # 


[- sk sie 
[-+---- 


Key: Dn = physical data pin n 
dn = logical data bit n 


D16-D31 


16=BiT 
BUS SIZE 


T2 11 


WaaNa 


NEGATED DURING 
Cunt | aa 


NOTE: NA#¥ MUST BE NEGATED 
HERE TO ALLOW RECOGNITION 
OF ASSERTED BS16# IN FINAL T2 


XXX NKRREXOXXXY 
DAAAAAAL f\ LYVAALAVAN 


LOOX 


CYCLE 2 
NON=PIPELINED 
(WRITE) 


CYCLE 1A 
NON=PIPELINED 
READ) 
PART TWO 


T2 T2 T2 


KXXXY XX 


BUS SIZE 


KXOXXXY 


BUS SIZE 
VYWV/Y \Y 


\/ 
AX ANZ \\ 


WV 
KX XX 


VALID 2 


d0=d15 


d16-d31 


231630-19 


Figure 5-15. Asserting BS16# (one wait state, non-pipelined address) 


generated for the two 16-bit bus cycles are closely 
related to each other. The addresses are the same 
except BEO# and BE1 # are always negated for the 
second cycle. This is because data on DO-D15 was 
already transferred during the first 16-bit cycle. 


Figures 5-14 and 5-15 show cases where assertion 
of BS16# requires a second 16-bit cycle for com- 
plete operand transfer. Figure 5-14 illustrates cycles 
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without wait states. Figure 5-15 illustrates cycles 
with one wait state. In Figure 5-15 cycle 1, the bus 
cycle during which BS16# is asserted, note that 
NA# must be negated in the T2 state(s) prior to the 
last T2 state. This is to allow the recognition of 
BS16# asserted in the final T2 state. The relation of 
NA# and BS16# is given fully in 5.4.3.4 Pipelined 
Address, but Figure 5-15 illustrates this only pre- 
caution you need to know when using BS16# with 
non-pipelined address. 
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5.4.3.4 PIPELINED ADDRESS 


Address pipelining is the option of requesting the 
address and the bus cycle definition of the next, in- 
ternally pending bus cycle before the current bus 
cycle is acknowledged with READY# asserted. 
ADS # is asserted by the 80386 when the next ad- 
dress is issued. The address pipelining option is con- 
trolled on a cycle-by-cycle basis with the NA# input 
signal. 


Once a bus cycle is in progress and the current ad- 
dress has been valid for at least one entire bus 
state, the NA# input is sampled at the end of every 
phase one until the bus cycle is acknowledged. Dur- 
ing non-pipelined bus cycles, therefore, NA# is 
sampled at the end of phase one in every T2. An 
example is Cycle 2 in Figure 5-16, during which NA# 
is sampled at the end of phase one of every T2 (it 
was asserted once during the first T2 and has no 
further effect during that bus cycle). 


80386 
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If NA# is sampled asserted, the 80386 is free to 
drive the address and bus cycle definition of the next 
bus cycle, and assert ADS #, as soon as it has a bus 
request internally pending. It may drive the next ad- 
dress as early as the next bus state, whether the 
current bus cycle is acknowledged at that time or 
not. 


Regarding the details of address pipelining, the 
80386 has the following characteristics: 


1) For NA# to be sampled asserted, BS16# must 
be negated at that sampling window (see Figure 
5-16 Cycles 3 and 4, and Figure 5-17 Cycles 2 
through 4). If NA# and BS16# are both sampled 
asserted during the last T2 period of a bus cycle, 
BS16# asserted has priority. Therefore, if both 
are asserted, the current bus size is taken to be 
16 bits and the next address is not pipelined. Con- 
ceptually, Figure 5-18 shows the internal 80386 
logic providing these characteristics. 
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Following any idle bus state (Ti), addresses are non-pipelined. Within non-pipelined bus cycles, NA# is only sampled during wait states. 
Therefore, to begin address pipelining during a group of non-pipelined bus cycles requires a non-pipelined cycle with at least one wait state 
(Cycle 2 above). 


Figure 5-16. Transitioning to Pipelined Address During Burst of Bus Cycles 
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Following any idle bus state (Ti) the address is always non-pipelined and NA# is only sampled during wait states. To start address pipelining 
after an idle state requires a non-pipelined cycle with at least one wait state (cycle 1 above). 
The pipelined cycles (2, 3, 4 above) are shown with various numbers of wait states. 


Figure 5-17. Fastest Transition to Pipelined Address Following Idie Bus State 


2) The next address may appear as early as the bus 
state after NA# was sampled asserted (see Fig- 
ures 5-16 or 5-17). In that case, state T2P is en- 
tered immediately. However, when there is not an 
internal bus request already pending, the next ad- 
dress will not be available immediately after NA# 
is asserted and T2l is entered instead of T2P (see 
Figure 5-19 Cycle 3). Provided the current bus cy- 
cle isn’t yet acknowledged by READY # asserted, 
T2P will be entered as soon as the 80386 does 
drive the next address. External hardware should 
therefore observe the ADS# output as confirma- 
tion the next address is actually being driven on 
the bus. 


3) Once NA# is sampled asserted, the 80386 com- 
mits itself to the highest priority bus request that 
is pending internally. It can no longer perform an- 
other 16-bit transfer to the same address should 


BS16# be asserted externally, so thereafter must 
assume the current bus size is 32 bits. Therefore 
if NA# is sampled asserted within a bus cycle, 
BS16# is ignored thereafter in that bus cycle (see 
Figures 5-16, 5-17, 5-19). Consequently, do not 
assert NA# during bus cycles which must have 
BS16# driven asserted. See 5.4.3.6 Dynamic 
Bus Sizing with Pipelined Address. 


4) Any address which is validated by a pulse on the 
80386 ADS# output will remain stable on the ad- 
dress pins for at least two processor clock peri- 
ods. The 80386 cannot produce a new address 
more frequently than every two processor clock 
periods (see Figures 5-16, 5-17, 5-19). 


5) Only the address and bus cycle definition of the 
very next bus cycle is available. The pipelining ca- 
pability cannot look further than one bus cycle 
ahead (see Figure 5-19 Cycle 1). 
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Figure 5-18. 80386 Internal 
Logic on NA# and BS16# 


The complete bus state transition diagram, including 
operation with pipelined address is given by 5-20. 
Note it is a superset of the diagram for non-pipelined 
address only, and the three additional bus states for 
pipelined address are drawn in bold. 


The fastest bus cycle with pipelined address con- 
sists of just two bus states, T1P and T2P (recall for 
non-pipelined address it is T1 and T2). T1P is the 
first bus state of a pipelined cycle. 


5.4.3.5 INITIATING AND MAINTAINING 
PIPELINED ADDRESS 


Using the state diagram Figure 5-20, observe the 
transitions from an idle state, Ti, to the beginning of 
a pipelined bus cycle, T1P. From an idle state Ti, the 
first bus cycle must begin with T1, and is therefore a 
non-pipelined bus cycle. The next bus cycle will be 
pipelined, however, provided NA# is asserted and 
the first bus cycle ends in a T2P state (the address 
for the next bus cycle is driven during T2P). The fast- 
est path from an idle state to a bus cycle with pipe- 
lined address is shown in bold below: 


Ti, Ti, Ti, .T1-T2-T2P,, TIP -T2P, 
ee No Ne“ 
idle non-pipelined _ pipelined 
states cycle cycle 


T1-T2-T2P are the states of the bus cycle that es- 
tablishes address pipelining for the next bus cycle, 
which begins with T1P. The same is true after a bus 
hold state, shown below: 


Th, Th, Th,,,.71-T2-T2P,, T1IP-T2P, 
US RC 
hold non-pipelined _ pipelined 
acknowledge cycle cycle 
states 
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The transition to pipelined address is shown func- 
tionally by Figure 5-17 Cycle 1. Note that Cycle 1 is 
used to transition into pipelined address timing for 
the subsequent Cycles 2, 3 and 4, which are pipe- 
lined. The NA# input is asserted at the appropriate 
time to select address pipelining for Cycles 2, 3 and 
4. 


Once a bus cycle is in progress and the current ad- 
dress has been valid for one entire bus state, the 
NA# input is sampled at the end of every phase one 
until the bus cycle is acknowledged. During Figure 5- 
17 Cycle 1 therefore, sampling begins in T2. Once 
NA# is sampled asserted during the current cycle, 
the 80386 is free to drive a new address and bus 
cycle definition on the bus as early as the next bus 
state. In Figure 5-16 Cycle 1 for example, the next 
address is driven during state T2P. Thus Cycle 1 
makes the transition to pipelined address timing, 
since it begins with T1 but ends with T2P. Because 
the address for Cycle 2 is available before Cycle 2 
begins, Cycle 2 is called a pipelined bus cycle, and it 
begins with T1P. Cycle 2 begins as soon as 
READY # asserted terminates Cycle 1. 


Example transition bus cycles are Figure 5-17 Cycle 
1 and Figure 5-16 Cycle 2. Figure 5-17 shows tran- 
sition during the very first cycle after an idle bus 
state, which is the fastest possible transition into ad- 
dress pipelining. Figure 5-16 Cycle 2 shows a tran- 
sition cycle occurring during a burst of bus cycles. In 
any case, a transition cycle is the same whenever it 
occurs: it consists at least of T1, T2 (you assert 
NA# at that time), and T2P (provided the 80386 has 
an internal bus request already pending, which it al- 
most always has). T2P states are repeated if wait 
states are added to the cycle. 


Note three states (T1, T2 and T2P) are only required 
in a bus cycle performing a transition from non- 
pipelined address into pipelined address timing, for 
example Figure 5-17 Cycle 1. Figure 5-17 Cycles 2, 
3 and 4 show that address pipelining can be main- 
tained with two-state bus cycles consisting only of 
T1P and T2P. 


Once a pipelined bus cycle is in progress, pipelined 
timing is maintained for the next cycle by asserting 
NA# and detecting that the 80386 enters T2P dur- 
ing the current bus cycle. The current bus cycle must 
end in state T2P for pipelining to be maintained in 
the next cycle. T2P is identified by the assertion of 
ADS #. Figures 5-16 and 5-17 however, each show 
pipelining ending after Cycle 4 because Cycle 4 
ends in T2l. This indicates the 80386 didn’t have an 
internal bus request prior to the acknowledgement 
of Cycle 4. If a cycle ends with a T2 or T2l, the next 
cycle will not be pipelined. 
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Figure 5-19. Details of Address Pipelining During Cycles with Wait States 
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ing (80386 drives new address and asserts ADS #). 
T1P—first clock of a pipelined bus cycle. 

Ti—idle state. 

Th—hold acknowledge state (80386 asserts HLDA). 


states: T2I, T2P and T1P. 


80386 


READY; 
HOLD 


READY# ASSERTED® 
HOLD 
REQUEST 
READY# ASSERTED + 
HOLD NEGATED® 
REQUEST PENDING 


READY# ASSERTED + 
HOLD NEGATED + 
NO REQUEST 


Asserting NA# for pipelined address gives access to three more bus 


Using pipelined address, the fastest bus cycle consists of T1P and T2P. 


SSERTED 


NEGA’ 
PENDING 


ADVANCE INFORMATION 


ASSERTED © 


NA# NEGATED 


TED * 


Z 
mA BERATED: A: 
woo BB 
3 
ce i 
33 731 
2 2 
3 


READY# NEGATED= 
(NO REQUEST + 
HOLD ASSERTED) 


READY# NEGATED* 


REQUEST PENDING* 
HOLD NEGATED 


READY# NEGATED 


231630-24 


Figure 5-20. 80386 Complete Bus States (including pipelined address) 


Realistically, address pipelining is almost always 
maintained as long as NA# is sampled asserted. 
This is so because in the absence of any other re- 
quest, a code prefetch request is always internally 
pending untii the instruction decoder and code pre- 
fetch queue are completely full. Therefore address 
pipelining is maintained for long bursts of bus cycles, 
if the bus is available and NA# is sampled asserted 
in each of the bus cycles. 


5.4.3.6 PIPELINED ADDRESS WITH DYNAMIC 
DATA BUS SIZING 


The BS16# feature allows easy interface to 16-bit 
data buses. When asserted, the 80386 bus interface 
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hardware performs appropriate action to make the 
transfer using a 16-bit data bus connected on 
DO-D15. 


There is a degree of interaction, however, between 
the use of Address Pipelining and the use of Bus 
Size 16. The interaction results from the multiple bus 
cycles required when transferring 32-bit operands 
over a 16-bit bus. If the operand requires both 16-bit 
halves of the 32-bit bus, the appropriate 80386 ac- 
tion is a second bus cycle to complete the operand’s 
transfer. It is this necessity that conflicts with NA# 
usage. 


When NA # is sampled asserted, the 80386 commits 
itself to perform the next internally pending bus re- 
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quest, and is allowed to drive the next internally been sampled asserted in the current cycle. If 
pending address onto the bus. Asserting NA# there- NA# is sampled asserted, the current data bus 
fore makes it impossible for the next bus cycle to size is assumed to be 32 bits. 

again access the current address on A2-A31, such 2) To also avoid conflict, if NA# and BS16# are 
as may be required when BS16# is asserted by the both asserted during the same sampling window, 
external hardware. BS16# asserted has priority and the 80386 acts 
To avoid conflict, the 80386 is designed with follow- i wee 
ing two provisions: 18, assures that BS16# is sampled asserted and 
1) To avoid conflict, the 80386 is designed to ignore NA# is sampled negated if both inputs are exter- 

BS 16 # in the current bus cycle if NA# has already nally asserted at the same sampling window. 
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Cycles 1 and 2 are pipelined. Cycle 1a cannot be pipelined, but its address can be inferred from that of Cycle 1, to externally simulate address 

pipelining during Cycle 1a. 


Figure 5-21. Using NA# and BS16# 
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Certain types of operands require no adjustment for 
correct transfer on a 16-bit bus. Those are read or 
write operands using only the lower half of the data 
bus, and write operands using only the upper half of 
the bus since the 80386 simultaneously duplicates 
the write data on the lower half of the data bus. For 
these patterns of Byte Enables and the R/W# sig- 
nals, BS16# need not be asserted at the 80386, 
allowing NA# to be asserted during the bus cycle if 
desired. 


5.4.4 Interrupt Acknowledge (INTA) 
Cycles 


In response to an interrupt request on the INTR in- 
put when interrupts are enabled, the 80386 performs 
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two interrupt acknowledge cycles. These bus cycles 
are similar to read cycles in that bus definition sig- 
nals define the type of bus activity taking place, and 
each cycle continues until acknowledged by 
READY # sampled asserted. 


The state of A2 distinguishes the first and second 
interrupt acknowledge cycles. The byte address 
driven during the first interrupt acknowledge cycle is 
4 (A31-A3 low, A2 high, BE3#-BE1# high, and 
BEO# low). The address driven during the second 
interrupt acknowledge cycle is 0 (A31-A2 low, 
BE3#-BE1# high, BEO# low). 
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Interrupt Vector (0-255) is read on DO-D7 at end of second Interrupt Acknowledge bus cycle. 
Because each Interrupt Acknowledge bus cycle is followed by idle bus states, asserting NA# has no practical effect. Choose the approach 


which is simplest for your system hardware design. 


Figure 5-22. interrupt Acknowledge Cycles 
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Figure 5-23. Halt Indication Cycle 


The LOCK# output is asserted from the beginning 5.4.5 Halt Indication Cycle 

of the first interrupt acknowledge cycle until the end 

of the second interrupt acknowledge cycle. Four idle The 80386 halts as a result of executing a HALT 
bus states, Ti, are inserted by the 80386 between instruction. Signaling its entrance into the halt state, 
the two interrupt acknowledge cycles, allowing at a halt indication cycle is performed. The halt indica- 
least 160 ns of locked idle time for future 80386 tion cycle is identified by the state of the bus defini- 
speed selections up to 24 MHz (CLK2 up to 48 tion signals shown in 5.2.5 Bus Cycle Definition 
MHz), for compatibility with spec TRHRL of the and a byte address of 2. BEO# and BE2# are the 


8259A Interrupt Controller. only signals distinguishing halt indication from shut- 
down indication, which drives an address of 0. Dur- 
During both interrupt acknowledge cycles, DO-D31 ing the halt cycle undefined data is driven on 


float. No data is read at the end of the first interrupt DO-D31. The halt indication cycle must be acknowl- 
acknowledge cycle. At the end of the second inter- edged by READY # asserted. 

rupt acknowledge cycle, the 80386 will read an ex- 

ternal interrupt vector from DO-D7 of the data bus. A halted 80386 resumes execution when INTR (if 
The vector indicates the specific interrupt number interrupts are enabled) or NMI or RESET is assert- 
(from 0-255) requiring service. ed. 
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5.4.6 Shutdown Indication Cycle 


The 80386 shuts down as a result of a protection 
fault while attempting to process a double fault. Sig- 
naling its entrance into the shutdown state, a shut- 
down indication cycle is performed. The shutdown 
indication cycle is identified by the state of the bus 
definition signals shown in 5.2.5 Bus Cycle Defini- 
tion and a byte address of 0. BEO# and BE2# are 
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PIPELINED 
(READ) 


TIP 


CLK2 [ 


peste ial bl 


BE1#, BE2#, BE3#, 
M/l0#, W/' RL 


BEO#, A2—A31, [ 
D/C# 


aos¢ [_ 
nag 
psi6¢[ 


READY# [ 


—— 
elon 


80386 


CYCLE 2 
PIPELINED 
(SHUTDOWN) 


VALID 2 


(| UNDEFINED 


ADVANCE INFORMATION 


the only signals distinguishing shutdown indication 
from halt indication, which drives an address of 2. 
During the shutdown cycle undefined data is driven 
on DO-D31. The shutdown indication cycle must be 
acknowledged by READY # asserted. 


A shutdown 80386 resumes execution when NMI or 
RESET is asserted. 


80386 REMAINS SHUTDOWN 
\/ 
XXX XXX! UNTIL NMI OR RESET 
IS ASSERTED. 

(XX VVVY 

XKXKX 80386 RESPONDS TO 
HOLD INPUT WHILE IN 
THE SHUTDOWN STATE. 


XXX XXX 
Homey AY 


XXXXKXKX 
— 


NOTE: SHUTDOWN CYCLE MUST BI 
ACKNOWLEDGED BY READY# 
ASSERTED. WAIT STATES MAY 
BE ADDED TO THE CYCLE IF 
DESIRED. 


\XAXXKXXAKXXAKXKM 


= -(FLOATING) 
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Figure 5-24. Shutdown Indication Cycle 
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5.5 OTHER FUNCTIONAL 
DESCRIPTIONS 


5.5.1 Entering and Exiting Hold 
Acknowledge 


The bus hold acknowledge state, Th, is entered in 
response to the HOLD input being asserted. In the 
bus hold acknowledge state, the 80386 floats all 
output or bidirectional signals, except for HLDA. 
HLDA is asserted as long as the 80386 remains in 
the bus hold acknowledge state. In the bus hold ac- 
knowledge state, all inputs except HOLD and RE- 
SET are ignored (also up to one rising edge on NMI 
is remembered for processing when HOLD is no 
longer asserted). 


cua” 


(82384 cu). 
Hovo[ 


Hioa[” 


BEO¥—BE3¥ 
A2-A31, M/1O# 
D/C#, W/R# 


ADS# : t beeen (FLOATING) -==-7 


wae SXXXXKXXXKXXXKXXXKKKN 


esi6¢[ XXXXXXXXXKKAAXXANAKAN 


reaorsl MXXXXRKKRRKKKKKKNARAK 


Locke XXXKX>----} (rLoatinc)-=--K KKK 


po- osi[ - 
231630-29 
NOTE: 
For maximum design flexibility the 80386 has no inter- 
nal pullup resistors on its outputs. Your design may re- 
quire an external pullup on ADS# and other 80386 out- 
puts to keep them negated during float periods. 


Figure 5-25. Requesting Hold from Idie Bus 


Th may be entered from a bus idle state as in Figure 
5-25 or after the acknowledgement of the current 
physical bus cycle if the LOCK # signal is not assert- 
ed, as in Figures 5-26 and 5-27. If asserting BS16# 
requires a second 16-bit bus cycle to complete a 
physical operand transfer, it is performed before 


HOLD is acknowledged, although the bus state dia- 
grams in Figures 5-13 and 5-20 do not indicate that 
detail. 


Th is exited in response to the HOLD input being 
negated. The following state will be Ti as in Figure 
5-25 if no bus request is pending. The following bus 
state will be T1 if a bus request is internally pending, 
as in Figures 5-26 and 5-27. 


Th is also exited in response to RESET being assert- 
ed. 


If a rising edge occurs on the edge-triggered NMI 
input while in Th, the event is remembered as a non- 
maskable interrupt 2 and is serviced when Th is exit- 
ed, unless of course, the 80386 is reset before Th is 
exited. 


5.5.2 Reset During Hold Acknowledge 


RESET being asserted takes priority over HOLD be- 
ing asserted. Therefore, Th is exited in reponse to 
the RESET input being asserted. If RESET is assert- 
ed while HOLD remains asserted, the 80386 drives 
its pins to defined states during reset, as in Table 
5-3 Pin State During Reset, and performs internal 
reset activity as usual. 


lf HOLD remains asserted when RESET is negated, 
the 80386 enters the hold acknowledge state before 
performing its first bus cycle, provided HOLD is still 
asserted when the 80386 would otherwise perform 
its first bus cycle. If HOLD remains asserted when 
RESET is negated, the BUSY # input is still sampled 
as usual to determine whether a self test is being 
requested, and ERROR # is still sampled as usual to 
determine whether an 80387 vs. an 80287 (or none) 
is present. 


5.5.3 Bus Activity During and 
Following Reset 


RESET is the highest priority input signal, capable of 
interrupting any processor activity when it is assert- 
ed. A bus cycle in progress can be aborted at any 
stage, or idle states or bus hold acknowledge states 
discontinued so that the reset state is established. 


RESET should remain asserted for at least 15 CLK2 
periods to ensure it is recognized throughout the 
80386, and at least 78 CLK2 periods if 80386 self- 
test is going to be requested at the falling edge. RE- 
SET asserted pulses less than 15 CLK2 periods may 
not be recognized. RESET pulses less than 78 CLK2 
periods followed by a self-test may cause the self- 
test to report a failure when no true failure exists. 
The additional RESET pulse width is required to 
clear additional state prior to a valid self-test. 
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HOLD is a synchronous input and can be asserted at any CLK2 edge, provided setup and hold (tag and to4) require- 
ments are met. This waveform is useful for determining Hold Acknowledge latency. 


Figure 5-26. Requesting Hold from Active Bus (NA# negated) 


Provided the RESET falling edge meets setup and 
hold times tgs and tgg, the internal processor clock 
phase is defined at that time, as illustrated by Figure 
5-28 and Figure 7-7. 


An 80386 self-test may be requested at the time RE- 
SET is negated by having the BUSY# input at a 
LOW level, as shown in Figure 5-28. The self-test 
requires (220) + approximately 60 CLK2 periods to 
complete. The self-test duration is not affected by 
the test results. Even if the self-test indicates a prob- 
lem, the 80386 attempts to proceed with the reset 
sequence afterwards. 
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After the RESET falling edge (and after the self-test 
if it was requested) the 80386 performs and internal 
initialization sequence for approximately 350 to 450 
CLK2 periods. Also during the initialization, between 
the 20th CLK2 period and the first bus cycle, the 
ERROR # input is sampled to determine the pres- 
ence of an 80387 coprocessor versus the presence 
of an 80287 (or no coprocessor). To distinguish be- 
tween an 80287 being present and no coprocessor 
being present requires a software test. 
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HOLD is a synchronous input and can be asserted at any CLK2 edge, provided setup and hold (to3 and tz4) require- 
ments are met. This waveform is useful for determining Hold Acknowledge latency. 


Figure 5-27. Requesting Hold from Idle Bus (NA# asserted) 


5.6 SELF-TEST SIGNATURE 


Upon completion of self-test (if self-test was re- 
quested by driving BUSY # low at the falling edge of 
the RESET signal) the AX and DX registers will each 
indicate O000H if the 80386 passed with no faults 
detected. This applies to all 80386 revision levels. 
Non-zero values in either AX or DX after self-test 
indicate that particular 80386 unit is faulty. 


5.7 COMPONENT AND REVISION 
IDENTIFIERS 


To assist 80386 users, the 80386 after reset holds a 
component identifier and revision identifier in its BH 
and BL registers respectively. BH contains 03H as 


86 


identification of the 80386 component. BL contains 
an unsigned binary number related to the compo- 
nent revision level. The 80386 revision identifier in 
BL begins chronologically with value zero and is 
subject to change (typically it will be incremented) 
with component steppings intended to have certain 
improvements or distinctions from previous step- 


pings. 


These features are intended to assist 80386 users 
to a practical extent. However, the revision identifier 
value is not guaranteed to change with every step- 
ping revision, or to follow a completely uniform nu- 
merical sequence, depending on the type or inten- 
tion of revision, or materials required to be changed. 
Intel has sole discretion over these characteristics of 
the component. 
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Figure 5-28. Bus Activity from Rest Until First Code Fetch 


Table 5-10. Component and Revision Identifier History 


80386 80386 
Stepping Component Revision Component Revision 


Identifier Identifier Stepping identifier Identifier 
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6. MECHANICAL DATA 


6.1 INTRODUCTION 


In this section, the physical packaging and its con- 
nections are described in detail. 


6.2 PIN ASSIGNMENT 


The 80386 pinout as viewed from the Substrate side 
of the component is shown by Figure 6-1. Its pinout 
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as viewed from the Pin side of the component is 
Figure 6-2. 


Vcc and GND connections must be made to multi- 
ple Voc and GND pins. Each Vcc and GND must be 
connected to the appropriate voltage level. External- 
ly strap all Vcc pins together close to the package, 
and similarly strap all GND pins. Preferrably, the cir- 
cuit board should include Voc and GND planes for 
power distribution. 


NOTE: 
Pins identified as “N.C.” should remain completely 
unconnected. 
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Figure 6-1. 80386 PGA Pinout—View from Top Side 
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Figure 6-2. 80386 PGA Pinout—View from Pin Side 
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Table 6-1. 80386 PGA Pinout—Functional Grouping 


N2 M5 D31 

P41 P3 D30 
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H2 D18 

H1 D17 

G1 D16 

Fi D15 

E1 D14 

E2 D13 

E3 Di2 

D1 D11 
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D6 
D5 W/R# 
D4 D/C# 
D3 M/lO# 
D2 LOCK # 
D1 
DO NA# 

BS16# 
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231630-35 
Figure 6-3. 132-Pin Ceramic PGA Package Dimensions 

6.3 Package Dimensions and A wide variety of available sockets allow low inser- 

Mounting tion force or zero insertion force mountings, and a 


choice of terminals such as _ soldertail, surface 
The initial 80386 package is a 132-pin ceramic pin mount, or wire wrap. Several applicable sockets are 
grid array (PGA). Pins of this package are arranged _ listed in Table 6-2. 
0.100 inch (2.54mm) center-to-center, in a 14 x 14 
matrix, three rows around. 
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6.4 PACKAGE THERMAL to determine whether the 80386 is within specified 
SPECIFICATION eee 

The 80386 is specified for operation when case tem- The PGA case temperature should be measured at 

perature is within the range of 0°C-85°C. The case the center of the top surface opposite the pins, as in 

temperature may be measured in any environment, Figure 6-4. 


MEASURE PGA CASE TEMPERATURE 
AT CENTER OF TOP SURFACE 


132=PIN PGA 


Figure 6-4. Measuring 80386 PGA Case Temperature 


Table 6-2. Several Socket Options for 132-Pin PGA 


* Low insertion force (LIF) soldertail 
55274-1 

* Amp tests indicate 50% reduction in insertion 
force compared to machined sockets 


Other socket options 

* Zero insertion force (ZIF) soldertail 
55583-1 

* Zero insertion force (ZIF) Burn-in version 
§5573-2 


Amp Incorporated 
(Harrisburg, PA 17105 U.S.A. 
Phone 717-564-0100) 


231630-45 
Cam handle locks in low profile position when substrate is installed (handle UP for 
open and DOWN for closed positions) 


courtesy Amp Incorporated 
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Table 6-2. Several Socket Options for 132-Pin PGA (Continued) 


Peel-A-Way™ Mylar and Kapton Peel-A-Way Carrier No. 132: 
Socket Terminal Carriers Kapton Carrier is KS132 
Low insertion force surface mount Mylar Carrier is MS132 


CS132-37TG : Molded Plastic Body KS132 
Low insertion force soldertail is shown below: 


CS132-01TG 

Low insertion force wire-wrap 
CS132-02TG (two level) 
CS132-03TG (three-level) 


Low insertion force press-fit 
CS132-05TG 


Advanced Interconnections 
(5 Division Street 
Warwick, Ri 02818 U.S.A. 
Phone 401-885-0485) 


courtesy Advanced Interconnections 
(Peel-A-Way Terminal Carriers 
U.S. Patent No. 4442938) 


* Low insertion force socket soldertail 
(for production use) 
2XX-6576-00-3308 (new style) 
2XX-6003-00-3302 (older style) 


* Zero insertion force soldertail 
(for test and burn-in use) 
2XX-6568-00-3302 


Textool Products 

Electronic Products Division/3M 
(1410 West Pioneer Drive 
Irving, Texas 75601 U.S.A. 
Phone 214-259-2676) 


231630-48 
courtesy Textoo! Products/3M 
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7. ELECTRICAL DATA 


7.1 INTRODUCTION 


The following sections describe recommended elec- 
trical connections for the 80386, and its electrical 
specifications. 


7.2 POWER AND GROUNDING 


7.2.1 Power Connections 


The 80386 is implemented in CHMOS III technology 
and has modest power requirements. However, its 
high clock frequency and 72 output buffers (address, 
data, control, and HLDA) can cause power surges 
as multiple output buffers drive new signal levels 
simultaneously. For clean on-chip power distribution 
at high frequency, 20 Vcc and 21 Vgss pins separate- 
ly feed functional units of the 80386. 


Power and ground connections must be made to all 
external Voc and GND pins of the 80386. On the 
circuit board, all Voc pins must be strapped closely 
together, preferrably on a Vcc plane. All Vss pins 
must be likewise strapped on the circuit board, pre- 
ferrably on a GND plane. 


7.2.2 Power Decoupling 
Recommendations 


Liberal decoupling capacitance should be placed 
near the 80386. The 80386 driving its 32-bit parallel 
address and data buses at high frequencies can 
cause transient power surges, particularly when driv- 
ing large capacitive loads. 


Low inductance capacitors and interconnects are 
recommended for best high frequency electrical per- 
formance. Inductance can be reduced by shortening 
circuit board traces between the 80386 and decou- 


pling capacitors as much as possible. Capacitors 
specifically for PGA packages are also commercially 
available, for the lowest possible inductance. 


7.2.3 Resistor Recommendations 


The ERROR # and BUSY # inputs have resistor pull- 
ups (of approximately 20 K2 built-in to the 80386 to 
keep these signals negated when neither 80287 or 
80387 are present in the system (or temporarily re- 
moved from its socket). 


In typical designs, the external pullup resistors 
shown in Table 7-1 are recommended. However, a 
particular design may have reason to adjust the re- 
sistor values recommended here, or alter the use of 
pullup resistors in other ways. 


7.2.4 Other Connection 
Recommendations 


For reliable operation, always connect unused in- 
puts to an appropriate signal level. N.C. pins should 
always remain unconnected. 


Particularly when not using interrupts or bus hold, 
(as when first prototyping, perhaps) prevent any 
chance of spurious activity by connecting these as- 
sociated inputs to GND: 


Pin Signal 
B7  INTR 
B8 NMI 
D14 HOLD 


If not using address pipelining, pullup D13 NA# to 
Voc: 


If not using 16-bit bus size, pullup C14 BS16# to 
Voc: 


Pullups in the range of 20 KN. are recommended. 


Table 7-1. Recommended Resistor Pullups to Vcc 


Pin and Signal Pullup Value 


E14 ADS# 20 KX +10% 


Lightly Pull ADS # Negated 
During 80386 Hold Acknowledge 
States 


Lightly Pull LOCK # Negated 
During 80386 Hold Acknowledge 
States 


C10 LOCK# 20 KN +10% 
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7.3 MAXIMUM RATINGS Table 7-2 is a stress rating only, and functional oper- 
ation at the maximums is not guaranteed. Functional 
E operating conditions are given in 7.3 D.C. Specifica- 
ee ees tions and 7.4 A.C. Specifications. 
80386-12 

Parameter 80386-16 Extended exposure to the Maximum Ratings may af- 
Maximum Rating fect device reliability. Furthermore, although the 
: é 80386 contains protective circuitry to resist damage 
Storage Temperature —65°C to + 150°C from static electric discharge, always take precau- 

Case Temperature Under Bias —65°C to + 110°C tions to avoid high static voltages or electric fields. 


Supply Voltage with Respect to Vgs} —0.5V to +6.5V 
Voltage on Other Pins —0.5V to Voc + 0.5V 


7.4 D.C. SPECIFICATIONS 
Functional Operating Range: Vcc = 5V +5%; Tcoase = 0°C to 85°C 


Table 7-3. 80386-16 and 80386-12 D.C. Characteristics 


80386-12 | 80386-12 
Parameter 80386-16 | 80386-16 4 
Min Max 
Input High Voltage | 20 | Voce vy QQr 


us| eLezinet tow votege__{_-02. ae 
ee ae ee 


Output Low Voltage 
400 mA 
400 mA 


lo. = 4mA: A2-A31, DO-D31 

lo. = 5mA: BEO#-BE3#, W/R#, 
pa [oueas Sones ee Fe = 1 MHz (Note 1) 
CLK2 Capacitance | | 20 | pF | F, = 1 MHz (Note 1) 


NOTE: 
1. Not tested. 


Output High Voltage 
lon = 1 mA: 
lou = 0.9 mA: 
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7.5 A.C. SPECIFICATIONS 


7.5.1 A.C. Spec Definitions 


The A.C. specifications, given in Tables 7-4 and 7-5, 
consist of output delays, input setup requirements 
and input hold requirements. All A.C. specifications 
are relative to the CLK2 rising edge crossing the 
2.0V level. 


A.C. spec measurement is defined by Figure 7-1. In- 
puts must be driven to the voltage levels indicated 
by Figure 7-1 when A.C. specifications are mea- 
sured. 80386 output delays are specified with mini- 
mum and maximum limits, measured as shown. The 
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— minimum input hold spec 
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minimum 80386 delay times are hold times provided 
to external circuitry. 80386 input setup and hold 
times are specified as minimums, defining the small- 
est acceptable sampling window. Within the sam- 
pling window, a synchronous input signal must be 
stable for correct 80386 operation. 


Outputs NA#, W/R#, D/C#, M/IO#, LOCK#, 
BEO#-BE3#, A2-A31 and HLDA only change at 
the beginning of phase one. DO-D31 (write cycles) 
only change at the beginning of phase two. The 
READY #, HOLD, BUSY#, ERROR#, PEREQ and 
DO-D31 (read cycles) inputs are sampled at the be- 
ginning of phase one. The NA#, BS16#, INTR and 
NMI inputs are sampled at the beginning of phase 
two. 


2V_ VALID 
0.8V OUTPUT n+#1 


(@) 


25 ¥ 2V VALID 
0.8v A\ 4 0.8V OUTPUT n+1 


DRIVE & 0.8V 0.8V A\ 


~~ 
TO 0.45V 
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Figure 7-1. Drive Levels and Measurement Points for A.C. Specifications 
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7.5.2 A.C. Specification Tables 
Functional Operating Range: Voc = 5V +5%; Tcoase = 0°C to 85°C 


Table 7-4. 80386-16 A.C. Characteristics 


80386-16 | 80386-16 
mms | eS 


i 


| cag (Woo — 08) 
a a, SS 
te _| seat Beatoey ft fae eae 


BEO#-BE3#, LOCK# Fog CL = 75 pF 
Valid Delay 

BEO#-BE3#, LOCK# (Note 1) 
Float Delay 

W/R#, M/IO#, D/C#, = 75 pF 
ADS #, Valid Delay 

W/R#, M/IO#, D/C#, 

ADS # Float Delay 

DO-D31 Write Data CL = 120 pF 
Valid Delay “ 

DO-D31 Write Da (Note 1) 
Float Delay 


Pm NaN pes [mm | 76 |Q-tr 
— 


re — 
Pts | READY Slip Time | 20 | 
two | READY HoldTime [3 | + 


DO-D31 Read =" 
Setup Time 

DO-D31 Read 

Hold Time 


ee HOU Sep Tine re a 
eee ee 
ries | RESETSeuptine [10 |_| ne | 74 | Wows 
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Table 7-4. 80386-16 A.C. Characteristics (Continued) 


Parameter 80386-16 80386-16 
Min Max 


Figure 
| 7-4 | (Note2) | 


Lowel 
1s 
Dns [74 | Note) | 


NMI, INTR Setup Time 


NMI, INTR Hold Time 


PEREQ, ERROR #, BUSY # 
Setup Time 


ta7 
t 

Lid herd 
NOTES: 


1. Float condition occurs when maximum output current becomes less than Io i ©... Fi is not tested but 
should be no longer than the valid delay. ~~ 
2. These inputs are allowed to be asynchronous to CLK2. The setup and “* " sstongaf for testing purposes, 


PEREQ, ERROR #, BUSY # 
Hold Time 


to assure recognition within a specific CLK2 period. 


80386-12 0285 
Min K- 


Frequency 


| CLK2Period |g 40 i 

CLK2 High Time ‘EE aK CEE 

[ft | CLK2High Time te 7 | YOY ns | 73 | ativoc-08y | 
| ns | 73 | 

Le] 


Half of CLK2 


> 
7 


rian | CiKe Low Time @ OY Ve | 

: 
73 | veo — av reaav | 
73 | oavie ves — 080 | 


C_ = 120 pF 


(Note 1) 


7-6 


i aK SA \ 
re | aan Waigg@@p [|_| 


BEO#-BEa#, LOCK# 1 
Valid Delay 


th4 
ADS # Float Delay 


DO-D31 Write Data 
Valid Delay 

t13 DO-D31 Write Data 1 
Float Delay 


W/R#, M/IO#, D/C#, —_ 
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Table 7-5. 80386-12 A.C. Characteristics (Continued) 


80386-12 | 80386-12 Ref. 
Min * Figure isa 


ria | Resove saps | ae Lao 
ef Resor Heme a ue. 


DO-D31 Read 

Setup Time @ 
DO-D31 Read 

Hold Time 


. 
ae 


ee a 
Mie | HOLDHodTine —@@I™| SOY | 
tes | RESET Soup YR PNWRREP | ns | 74 | tote 
Pe oe 7) 
a. co 
\ 


ee prog 7-4 (Note 2) 
Sep Time 
PEREQ BAF OR #, BUSY # 7-4 (Note 2) 
Hold Timé 


NOTES: 

1. Float condition occurs when maximum output current becomes less than Io in magnitude. Float delay is not tested, but 
should be no longer than the valid delay. 

2. These inputs are allowed to be asynchronous to CLK2. The setup and hold specifications are given for testing purposes, 
to assure recognition within a specific CLK2 period. 


Py 
R 


Py ie 
& &R 


7.5.3 A.C. Test Loads 7.5.4 A.C. Timing Waveforms 


80386 
OUTPUT 


i. 


231630-38 
C_ = 120 pF on A2-A31, DO-D31 
Ci. = 75 pF on BEO#-BE3#, W/R#, M/IO#, D/C#, ADS#, 
LOCK #, HLDA 
C,, includes all parasitic capacitances. 


231630-39 


Figure 7-2. A.C. Test Load Figure 7-3. CLK2 Timing 
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DO=D31 
(INPUT) 


RESET 


BUSY#, 
ERROR# 
PEREQ 


NAg 


231630-40 


BEO#-BE3#, 
LOCK# 


W/R#,M/lO#, 
D/c¥,ADS# | 


A2-A31 


DO-D31 


(ouTPuT) [ VALID n AW VALID n#1 


HLDA 
- 231630-41 


Figure 7-5. Output Valid Delay Timing 
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Ti OR T1 


BEO#-BE3#, 
LOCK# 


W/R#,M/lO#, 
D/C#, ADS# 


ALSO APPLIES TO DATA FLOAT WHEN WRITE 
CYCLE IS FOLLOWED BY READ OR IDLE 


MIN MAX © | [MIN MA 


231630-42 


Figure 7-6. Output Float Delay and HLDA Valid Delay Timing 


—+—— RESET ———_> | INITIALIZATION SEQUENCE ——————> 
$2 OR $1 $2 OR $1 


231630-43 


The second internal processor phase following RESET high-to-low transition (provided tas and tag are met) is $2. 


Figure 7-7. RESET Setup and Hold Timing, and Internal Phase 
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7.6 DESIGNING FOR ICE-386 USE 


The 80386 in-circuit emulator product is ICE-386. 
Because of the high operating frequency of 80386 
systems and ICE-386, there is no cable separating 
the ICE-386 probe module from the target system. 
The ICE-386 probe module has several electrical 
and mechanical characteristics that should be taken 
into consideration when designing the hardware. 


Capacitive loading: |CE-386 adds up to 25 pF to 
each line. 


Drive requirement: ICE-386 adds one standard 
TTL load on the CLK2 line, up to one advanced low- 
power Schottky TTL load per control signal line, and 
one advanced low-power Schottky TTL load per ad- 
dress, byte enable, and data line. These loads are 
within the probe module and are driven by the 
probe’s 80386, which has standard drive and load- 
ing capability listed in Tables 7-3 and 7-4. 


Power requirement: For noise immunity the ICE- 
386 probe is powered by the user system. The high- 
speed probe circuitry draws up to 1.1A plus the max- 
imum 80386 Icc from the user 80386 socket. 


80386 location and orientation: The ICE-386 
probe requires lateral clearance illustrated in Figure 
7-8, viewed from above the user 80386 socket. The 


80386 


View from above user 80386 socket 


ADVANCE INFORMATION 


ICE-386 probe module alone requires vertical clear- 
ance 1.25 inches (3.2 cm) above the height of sur- 
rounding circuitry. The Optional Interface Board 
(OIB), used for extra electrical buffering initially, has 
the same lateral clearance as Figure 7-8, and adds 
0.5 inches (1.3 cm) to the vertical clearance. 


READY # drive: The ICE-386 system may be able 
to clear a user system READY # hang if the user’s 
READY # driver is implemented with an open-collec- 
tor or tri-state device. 


Optional Interface Board (OIB) and CLK2 speed 
reduction: When the ICE-386 processor probe is 
first attached to an unverified user system, the OIB 
helps ICE-386 function in user systems with bus 
faults (shorted signals, etc.). After electrical verifica- 
tion it may be removed. Only when the OIB is in- 
stalled, the user system must have a reduced CLK2 
frequency of 16 MHz maximum. 


Cache coherence: ICE-386 loads user memory by 
performing 80386 write cycles. Note that if the user 
system is not designed to update or invalidate its 
cache (if it has a cache) upon processor writes to 
memory, the cache could contain stale instruction 
code and/or data. For best use of ICE-386, the user 
should consider designing the cache (if any) to up- 
date itself automatically when processor writes oc- 
cur, or find another method of maintaining cache 
data coherence with main user memory. 


MINIMUM CABLE BEND RADIUS: 5 INCHES (12.7 cm) 


Figure 7-8. ICE-386 Lateral Clearance Requirements (Preliminary) 


102 


intel 


80386 


ADVANCE INFORMATION 


8. INSTRUCTION SET 


This section describes the 80386 instruction set. A 
table lists all instructions along with instruction en- 
coding diagrams and clock counts. Further details of 
the instruction encoding are then provided in the fol- 
lowing sections, which completely describe the en- 
coding structure and the definition of all fields occur- 
ring within 80386 instructions. 


8.1 80386 INSTRUCTION ENCODING 
AND CLOCK COUNT SUMMARY 


To calculate elapsed time for an instruction, multiply 
the instruction clock count, as listed in Table 8-1 
below, by the processor clock period (e.g. 62.5 ns 
for an 80386-16 operating at 16 MHz (32 MHz CLK2 
signal)). The actual clock count of an 80386 pro- 
gram will average 5% more than the calculated 
clock count due to instruction sequences which exe- 
cute faster than they can be fetched from memory. 
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For more detailed information on the encodings of 
instructions refer to section 8.2 Instruction Encod- 
ings. Section 8.2 explains the general structure of 
instruction encodings, and defines exactly the en- 
codings of all fields contained within the instruction 
encoding. 


Instruction Clock Count Assumptions 


1. The instruction has been prefetched, decoded, 
and is ready for execution. 


2. Bus cycles do not require wait states. 


3. There are no local bus HOLD requests delaying 
processor access to the bus. 


4. No exceptions are detected during instruction ex- 
ecution. 


Instruction Clock Count Notation 


1. If two clock counts are given, the smaller refers to 
a register operand and the larger refers to a mem- 
ory operand. 

2.n = number of times repeated. 


3. m = number of bytes of code in next instruction 
executed. 


intel 80386 ADVANGE INFORMATION 


Table 8-1. 80386 Instruction Set Clock Count Summa: 
[| cuockcount [| NOTES | 


INSTRUCTION FORMAT 


GENERAL DATA TRANSFER 
MOV = Move: 


Register to Register/Memory 1000100w | modreg r/m 


Register/Memory to Register 1000101w | modreg = r/m 
Immediate to Register/Memory mod000 f/m 
Immediate to Register 1011Ww_ reg} immediate data 
Memory to Accumulator (short form) 1010000w | fulldisplacement 


Accumulator to Memory (short form) 1010001w | full displacement 


Register Memory to Segment Register 10001110 | modOsreg r/m 
Segment Register to Register/Memory 10001100 | modOsreg r/m 
MOVSX = Move With Sign Extension 
Register From Register/Memory 00001111 1011111W 


MOVZX = Move With Zero Extension 


| | 
8 8 


es 


Register From Register/Memory 00001111 
PUSH = Push: 
Memory 11111111 |mod110 f/m 


Register 01010 reg 


Segment Register (ES, CS, SS or DS) 000sregi10 


Segment Register (FS or GS) 00001111 10sreg000 


Immediate 011010s0 | immediate data 


PUSHA = Push All 01100000 
POP = Pop 
Memory 10001111 |mod000 f/m 


Register 01011 reg 


Segment Register (ES, CS, SS or DS) 000sregi11 


Segment Register (FS or GS) 00001111 10sreg001 


POPA = Pop All 01100001 


XCHG = Exchange 


Register/Memory With Register 1000011w | modreg r/m 
Register With Accumulator (short form) 10010 reg 

IN = Input from: 
Fixed Port 
Variable Port 1110110w 
OUT = Output to: 
Fixed Port 1110011Ww port number 


Variable Port 1110111W 


LEA = Load EA to Register 10001101 | modreg r/m 
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SEGMENT CONTROL 

LDS = Load Pointer to DS 

LES = Load Pointer to ES 

LFS = Load Pointer to FS 

LGS = Load Pointer to GS 

LSS = Load Pointer to SS 

FLAG CONTROL 

CLC = Clear Carry Flag 

CLD = Clear Direction Fiag 

CLI = Clear Interrupt Enable Flag 
CLTS = Clear Task Switched Flag 
CMC = Complement Carry Flag 
LAHF = Load AH into Flag 

POPF = Pop Flags 

PUSHF = Push Flags 

SAHF = Store AH into Flags 

STC = Set Carry Flag 

STD = Set Direction Fiag 

STI = Set Interrupt Enable Flag 


ARITHMETIC 
ADD = Add 


Register to Register 

Register to Memory 

Memory to Register 

Immediate to Register/Memory 
Immediate to Accumulator (short form) 
ADC = Add With Carry 

Register to Register 

Register to Memory 

Memory to Register 

Immediate to Register/Memory 
Immediate to Accumulator (short form) 


INC = Increment 
Register/Memory 


Register 


SUB = Subtract 


Register from Register 


Table 8-1. 80386 Instruction Set Clock Count Summa 


11000101 


11000100 


g 
3 
3 


00001111 10110100 


00001111 


d 


00001111 10110010 


3 


| 
Fy 


00001111 00000110 


11110101 


10011100 


000000dw | modreg r/m 


! 
8 


3 
3 


0000000w if 


0000001w r/m 


g 
E 


100000sw | mod000 1r/m| immediate data 


0000010w immediate data 


g 
F} 


000100dw t/m 


0001000w | modreg r/m 


0001001w | modreg r/m 


100000sw | mod010 1r/m| immediate data 


0001010w immediate data 


° 
° 
° 


001010dw | modreg 
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intel 80386 ADVANCE INFORMATION 


Table 8-1. 80386 Instruction Set Clock Count Summary (Continued) 


ARITHMETIC (Continued) 


Z 
3 
3 


Register from Memory 0010100w 


i 
SB 


Memory from Register 0010101iw 
Immediate from Register/Memory 100000sw |mod101_ r/m| immediate data 


immediate from Accumulator (short form) 0010110w immediate data 


'SBB = Subtract with Borrow 


Register from Register 000110dw |modreg r/m 


Register from Memory 0001100w |mod reg r/m 


1 


a 
E 
3 


Memory from Register 0001101w 


Immediate from Register/Memory 100000sw |mod011_ r/m| immediate data 
Immediate from Accumulator (short form) 0001110w immediate data 

DEC = Decrement 
Register/Memory reg001 = r/m 


01001 reg 


001110dw 


Z 
3 


a 
3 
3 


0011100w |m 


E 
3 


Immediate with Register/Memory 100000sw 111  1r/m| immediate data 


3 
i 
Oo 
ry 
BS 


Immediate with Accumulator (short form) 


°o 
_ 
wai 


NEG = Change Sign 
AAA = ASCII Adjust for Add 
AAS = ASCII Adjust for Subtract 


IDAA = Decimal Adjust for Add 00100111 


IDAS = Decimal Adjust for Subtract 


MUL = Multiply (unsigned) 


[Accumulator with Register/Memory 1111011w |mod100 r/m 
Multiplier-Byte 9-14/12-17 | 9-14/12-17 
-Word 9-22/12-25 | 9-22/12-25 
-Doubleword 9-38/12-41 | 9-38/12-41 


IMUL = Integer Multiply (signed) 
[Accumulator with Register/Memory 1111011w}mod101 = r/m 
Multiplier-Byte 9-14/12-17 | 9-14/12-17 
-Word 9-22/12-25 | 9-22/12-25 
-Doubleword 9-38/12-41 | 9-38/12-41 


Register with Register/Memory 00001111 
Multiplier-Byte 9-14/12-17 | 9-14/12-17 
-Word 9-22/12-25 | 9-22/12-25 
-Doubleword 9-38/12-41 | 9-38/12-41 


Register/Memory with Immediate to Register mod reg r/m| immediate data 
Multiplier-Byte 9-14/12-17 | 9-14/12-17 
-Word 9-22/12-25 | 9-22/12-25 
-Doubleword 9-38/12-41 | 9-38/12-41 
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Table 8-1. 80386 Instruction Set Clock Count Summary (Continued) 


INSTRUCTION FORMAT 


ARITHMETIC (Continued) 
DIV = Divide (Unsigned) 


Accumulator by Register/Memory 


Divisor—Byte 
—Word 
—Doubleword 


IDIV = Integer Divide (Signed) 
.ccumulator By Register/Memory 


Divisor—Byte 
—Word 
—Doubleword 


AAD = ASCIl Adjust for Divide 11010101 | 00001010 
|AAM = ASCII Adjust for Multiply 11010100 | 00001010 
BW = Convert Byte to Word 10011000 
WD = Convert Word to Double Word; 10011001 


LOGIC 


Shift Rotate Instructions 
Not Through Carry (ROL, ROR, SAL, SAR, SHL, and SHR) 


Register/Memory by 1 

Register/Memory by CL 

Register/Memory by Immediate Count | 1100000w 
hrough Carry (RCL and RCR) 

Register/Memory by 1 1101000w |mod 

Register/Memory by CL 1101001w |mod 


Register/Memory by Immediate Count | 1100000w 


SHL/SAL 

SHR 

SAR 
SHLD = Shift Left Double 


Register/Memory by Immediate 


Register/Memory by CL 


ISHRD = Shift Right Double 
Register/Memory by Immediate 


Register/Memory by CL 


ND = And 
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Table 8-1. 80386 Instruction Set Clock Count Summary (Continued) 


ARITHMETIC (Continued) 


3 
E 
3 


Register to Memory 0010000w 


Z 
a 
3 


Memory to Register 0010001w 
Immediate to Register/Memory 100000sw |mod100_ 1r/m| immediate data 
Immediate to Accumulator (Short Form) 0010010w | immediate data 


TEST = And Function to Flags, No Result 


Register/Memory and Register 1000010w |modreg r/m 


: 


Immediate Data and Register/Memory 000 r/m| immediate data 


Immediate Data and Accumulator 
(Short Form) 1010100w | immediate data 


OR = Or 
Register to Register 000010dw 


Z 
E 
. 


2 
a 
3 


Register to Memory 0000100w 


Memory to Register 0000101w |modr 


3 
3 


Immediate to Register/Memory 100000sw |mod001_ r/m| immediate data 


Immediate to Accumulator (Short Form) 0000110w | immediate data 
XOR = Exclusive Or 
Register to Register 001100dw 


g 
3 
3 


a 
E 
3 


Register to Memory 0011000w 


mod reg r/m 


Memory to Register 0011001w 


Immediate to Register/Memory 100000sw |mod110_ 1r/m| immediate data 


Immediate to Accumulator (Short Form) 0011010w | immediate data 


d 


NOT = Invert Register/Memory 1111011w 010 f/m 

STRING MANIPULATION 

MPS = Compare Byte Word 

INS = Input Byte/Word from DX Port 

LODS = Load Byte/Word to AL/AX/EAX 

MOVS = Move Byte Word 1010010w 

OUTS = Output Byte/Word to DX Port 

SCAS = Scan Byte Word 1010111W 

STOS = Store Byte/Word from 
AL/AX/EX 

XLAT = Translate String 11010111 


Repeated by Count in CX 


REPE CMPS = Compare String 
(Find Non-Match) 
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Table 8-1. 80386 Instruction Set Clock Count Summary (Continued) 


INSTRUCTION FORMAT 


STRING MANIPULATION (Continued) 
IREPNE CMPS = Compare String 
(Find Match) 


REP INS = Input String 11110010 | 0110110w 


REP LODS = Load String 


REP MOVS = Move String 11110010 | 1010010w 


REP OUTS = Output String 11110010 


IREPE SCAS = Scan String 
(Find Non-AL/AX/EAX) 1010111w 


REPNE SCAS = Scan String 
(Find AL/AX/EAX) 


REP STOS = Store String 
BIT MANIPULATION 


3 
8 
C3 


BSF = Scan Bit Forward 00001111 


IBSR = Scan Bit Reverse 00001111 


i 
3 
3 


BT = Test Bit 


Register/Memory, Immediate 00001111 ‘/m| immed 8-bit data 


Register/Memory, Register 00001111 | 10100011 


BTC = Test Bit and Complement 
Register/Memory, Immediate 00001111 


Register/Memory, Register 


BTR = Test Bit and Reset 
Register/Memory, Immediate 


Register/Memory, Register 00001111 


i 
3 
3 


BTS = Test Bit and Set 


Register/Memory, Immediate 00001111 010 = r/m{iimmed 8-bit data 


q 


Register/Memory, Register 00001111 
BIT STRING MANIPULATION 


i 
3 
3 


IBTS = Insert Bit String 00001111 | 10100111 


XBTS = Extract Bit String 00001111 | 10100110 


CONTROL TRANSFER 
CALL = Call 
Direct Within Segment 11101000 | full displacement 


Register/Memory 


Indirect Within Segment 11111111 {mod010 f/m 


Direct Intersegment 10011010 | offset, selector 
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Table 8-1. 80386 Instruction Set Clock Count Summary (Continued) 


CONTROL TRANSFER (Continued) 
Protected Mode Only (Direct Intersegment) 


Via Call Gate to Same Privilege Level hk 
Via Call Gate to Different Privilege Level, 

(No Parameters) hj.kr 
Via Call Gate to Different Privilege Level, 

(x Parameters) hj. kr 
From 286 Task to 286 TSS hj.kr 
From 286 Task to 386 TSS hj.kr 
From 286 Task to Virtual 8086 Mode h,j,.k,r 
From 386 Task to 286 TSS hj.kr 
From 386 Task to 386 TSS hk 
From 386 Task to Virtual 8086 Mode hj,.kr 


Indirect Intersegment aataa4i4 | mod011 r/m hj.kr 


Protected Mode Only (Indirect Intersegment) 

Via Call Gate to Same Privilege Level hj.kr 
Via Call Gate to Different Privilege Level, 

(No Parameters) hj.kr 
Via Call Gate to Different Privilege Level, 

(x Parameters) h,j,.k,r 
From 286 Task to 286 TSS hj.kr 
From 286 Task to 386 TSS hj.kr 


From 286 Task to Virtual 8086 Mode hj.kr 

From 386 Task to 286 TSS hj. kr 

From 386 Task to 386 TSS hj.kr 

From 386 Task to Virtual 8086 Mode hj.kr 
JMP = Unconditional Jump 


Short | 11101001 | 8-bit displacement 
Direct within Segment full displacement 


Register/Memory Indirect within Segment REREEEELe mod100 _r/m 


Direct Intersegment offset, selector ik 


Protected Mode Only (Direct Intersegment) 
Via Call Gate to Same Privilege Level hj.kr 
From 286 Task to 286 TSS hj kr 
From 286 Task to 386 TSS hj.kr 
From 286 Task to Virtual 8086 Mode hj.kr 
From 386 Task to 286 TSS hjkr 
From 386 Task to 386 TSS hj.kr 
From 386 Task to Virtual 8086 Mode hk 


Indirect Intersegment 11111111 |[mod101 r/m hj. kr 


Protected Mode Only (indirect Intersegment) 
Via Call Gate to Same Privilege Level hj.kr 
From 286 Task to 286 TSS hike 
From 286 Task to 386 TSS hij. kr 
From 286 Task to Virtual 8086 Mode hijkr 
From 386 Task to 286 TSS hjkr 
From 386 Task to 386 TSS hj.kr 
From 386 Task to Virtual 8086 Mode h jkr 
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INSTRUCTION FORMAT 


CONTROL TRANSFER (Continued) 
RET = Return from CALL: 


Within Segment 11000011 


Within Segment Adding Immediate to SP 11000010 


! 


Intersegment 


Intersegment Adding Immediate to SP 11001010 16-bit disp! 


Protected Mode Only (RET): 
to Different Privilege Level 
Intersegment 
Intersegment Adding Immediate to SP 


CONDITIONAL JUMPS 

NOTE: Times Are Jump “Taken or Not Taken” 

JO = Jump on Overflow 
8-Bit Displacement 


01110000 8-bit disp! 


10000000 | full displacement 


Full Displacement 00001111 


JNO = Jump on Not Overflow 


8-Bit Displacement 01110001 8-bit disp! 


10000001 | full displacement 


Full Displacement 00001111 


JB/JNAE = Jump on Below/Not Above or Equal 


8-Bit Displacement 01110010 8-bit disp! 


10000010 | full displacement 


8-bit disp! 
10000011 | full displacement 


00001111 


Full Displacement 


JNB/JAE = Jump on Not Below/Above or Equal 
8-Bit Displacement 


Full Displacement 00001111 


JE/JZ = Jump on Equal/Zero 


8-Bit Displacement 01110100 8-bit disp! 


10000100 | full displacement 


Full Displacement 00001111 


JNE/JNZ = Jump on Not Equal/Not Zero 


8-Bit Displacement 8-bit displ 


10000101 


Full Displacement 00001111 full displacement 


JBE/JNA = Jump on Below or Equal/Not Above 
8-Bit Displacement 


8-bit disp! 


10000110 | full displacement 


Full Displacement 00001111 


i 


JNBE/JA = Jump on Not Below or Equal/Above 


8-Bit Displacement 


8-bit displ 


10000111 | full displacement 


8-bit disp! 


Full Displacement 
JS = Jump on Sign 
8-Bit Displacement 


00001111 


01111000 


Full Displacement 00001111 10001000 | full displacement 
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[cuockcount [| _noTes | 
Real 
Address Protected 
Mode or Virtual 
Virtual Address 
8086 Mode 
Mode 


gh 
g,h,r 
gh jkr 


9. hj, kr 
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Table 8-1. 80386 Instruction Set Clock Count Summary (Continued) 


INSTRUCTION 


CONDITIONAL JUMPS (Continued) 
JNS = Jump on Not Sign 
8-Bit Displacement 8-bit disp! 7+mor3 


Full Displacement 00001111 10001001 | full displacement mor3 


JP/JPE = Jump on Parity/Parity Even 
8-Bit Displacement 


] 
: 


Full Displacement 00001111 10001010 | full displacement 


i 


JNP/JPO = Jump on Not Parity/Parity 
8-Bit Displacement 


il 
8 


Full Displacement 00001111 10001011 | full displacement 


JL/JNGE = Jump on Less/Not Greater or Equal 
8-Bit Displacement 8-bit disp! 


Full Displacement 00001111 10001100 | full displacement 


JNL/JGE = Jump on Not Less/Greater or Equal 
8-Bit Displacement 8-bit disp! 


Full Displacement 00001111 10001101 | full displacement 


JLE/JNG = Jump on Less or Equal/Not Greater 
8-Bit Displacement 8-bit disp! 


= 


Full Displacement 00001111 10001110 | fulldisplacement 


JNLE/JG = Jump on Not Less or Equal/Greater 
8-Bit Displacement 


g 
' 


Full Displacement 00001111 full displacement 


JCXZ = Jump on CX Zero 


Qe 
4 
2 


JECXZ = Jump on ECX Zero 


(Operand Size Prefix Differentiates JCXZ 


j 


JECXZ) 


LOOP = Loop CX Times 11100010 8-bit displ 


LOOPZ/LOOPE = Loop with 
Zero/Equal 11100001 8-bit disp! 
LOOPNZ/LOOPNE = Loop While 
Not Zero 11100000 


, 


CONDITIONAL BYTE SET 
NOTE: Times Are Register/Memory 
SETO = Set Byte on Overflow 
To Register/Memory 00001111 


10010000 |mod000 f/m 


SETNO = Set Byte on Not Overflow 
To Register/Memory 00001111 


10010001 |mod000 f/m 


SETB/SETNAE = Set Byte on Below/Not Above or Equal 
To Register/Memory | 00001111 


10010010 |mod000 1r/m 
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Table 8-1. 80386 Instruction Set Clock Count Summa 


|__clockcounr | Notes 
Real Real 
INSTRUCTION FORMAT Address | Protected Address Protected 
Mode or Virtual Mode or Virtual 
Virtual Address Virtual Address 
8086 Mode 8086 Mode 
Mode Mode 


CONDITIONAL BYTE SET (Continued) 
SETNB = Set Byte on Not Below/Above or Equal 
To Register/Memory 
SETE/SETZ = Set Byte on Equal/Zero 
To Register/Memory 00001111 


SETNE/SETNZ = Set Byte on Not Equal/Not Zero 
To Register/Memory | 00001111 


SETBE/SETNA = Set Byte on Below or Equal/Not Above 


To Register/Memory | 00001111 10010110 | mod 


°o 
° 
° 


: 
i 
: 
2 
3 
4 
i 
2 
; 
3 


To Register/Memory | 00001111 


3 
& 
° 
° 
° 


SETS = Set Byte on Sign 
To Register/Memory 00001111 


10011000 
SETNS = Set Byte on Not Sign 
To Register/Memory 00001111 mod000_r/m 
SETP/SETPE = Set Byte on Parity/Parity Even 
To Register/Memory 00001111 
SETNP/SETPO = Set Byte on Not Parity/Parity Odd 
To Register/Memory | 00001111 | 10011011 | 
SETL/SETNGE = Set Byte on Less/Not Greater or Equal 
To Register/Memory | 00001111 
SETNL/SETGE = Set Byte on Not Less/Greater or Equal 


To Register/Memory | 00001111 01111101 


SETLE/SETNG = Set Byte on Less or Equal/Not 
To Register/Memory | 00001111 


2 


000 r/m 


o 
°o 
° 


SETNLE/SETG = Set Byte on Not Less or Equal/Greater 
To Register/Memory | 00001111 000 f/m 


ENTER = Enter Procedure 11001000 | 16-bit displacement, 8-bit level 


LEAVE = Leave Procedure 11001001 


| 
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INTERRUPT INSTRUCTIONS 
INT = Interrupt: 


Type Specified 
Type 3 11001100 
INTO = Interrupt 4 if Overflow Flag Set 


IfOF =1 
IfOF =0 


01100010 


Bound = Interrupt 5 if Detect Value 
Out of Range 


If Out of Range 
If In Range 


Protected Mode Only (INT) 
INT: Type Specified 

Via Interrupt or Trap Gate 

to Same Privilege Level 
Via Interrupt or Trap Gate 

to Different Privilege Level 
From 286 Task to 286 TSS via Task Gate 
From 286 Task to 386 TSS via Task Gate 
From 268 Task to virt 8086 md via Task Gate 
From 386 Task to 286 TSS via Task Gate 
From 386 Task to 386 TSS via Task Gate 
From 368 Task to virt 8086 md via Task Gate 
From virt 8086 md to 286 TSS via Task Gate 
From virt 8086 md to 386 TSS via Task Gate 


INT: TYPE 3 

Via Interrupt or Trap Gate 

to Same Privilege Level 
Via Interrupt or Trap Gate 

to Different Privilege Level 
From 286 Task to 286 TSS via Task Gate 
From 286 Task to 386 TSS via Task Gate 
From 268 Task to Virt 8086 md via Task Gate 
From 386 Task to 286 TSS via Task Gate 
From 386 Task to 386 TSS via Task Gate 
From 368 Task to Virt 8086 md via Task Gate 
From Virt 8086 md to 286 TSS via Task Gate 
From Virt 8086 md to 386 TSS via Task Gate 


INTO: 


Via Interrupt or Trap Grate 

to Same Privilege Level 
Via Interrupt or Trap Gate 

to Different Privilege Level 
From 286 Task to 286 TSS via Task Gate 
From 286 Task to 386 TSS via Task Gate 
From 268 Task to virt 8086 md via Task Gate 
From 386 Task to 286 TSS via Task Gate 
From 386 Task to 386 TSS via Task Gate 
From 368 Task to virt 8086 md via Task Gate 
From virt 8086 md to 286 TSS via Task Gate 
From virt 8086 md to 386 TSS via Task Gate 
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e,g,h,j, kr 
6ghjkKr 


fgike 


f,g.j.k.r 
f,g, j,k, 6 
f,g. jkr 
f,g.j.k.r 
f,g,j,k.r 
f,g,j,k.r 
f,g, j,k, ¢ 
f.gikr 
figjkr 


fg.) Kr 


f.g.ik,r 
f.g.jk.r 
f,g.j.kr 
f.gjkr 
f,g,j.k,r 
f.gjk.r 
f,g,j,k,r 
fgaiker 
f,g, j,k, 


fgikr 


f,g.j.k,r 
faikr 
faike 
f,g.jk.r 
f.g.j.k.r 
f,g.j.k.r 
f,g.i,k,r 
f,g.j,k,r 
f.g.j,k.r 
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Table 8-1. 80386 Instruction Set Clock Count Summary (Continued) 


| clockcount | NOTES 
Real Real 
INSTRUCTION FORMAT Address | Protected Address 
Mode or Virtual Mode or 
Virtual Address Virtual 
8086 Mode 8086 
Mode Mode 


INTERRUPT INSTRUCTIONS (Continued) 
BOUND: 


Via Interrupt or Trap Gate 

to Same Privilege Level Laiker 
Via Interrupt or Trap Gate 

to Different Privilege Level figjkr 
From 286 Task to 286 TSS via Task Gate fg. i. kr 
From 286 Task to 386 TSS via Task Gate fgikr 
From 268 Task to virt 8086 Mode via Task Gate fgikr 
From 386 Task to 286 TSS via Task Gate f,g.ik,r 
From 386 Task to 386 TSS via Task Gate 294 fgikr 
From 368 Task to virt 8086 Mode via Task Gate f,g.j.k.r, 
From virt 8086 Mode to 286 TSS via Task Gate fLaikr 
From virt 8086 Mode to 386 TSS via Task Gate f£gikr 


INTERRUPT RETURN 


IRET = Interrupt Return ghjkr 


Protected Mode Only (IRET) 
To the Same Privilege Level gh i, kr 
To Different Privilege Level gh,j,kr 
From 286 Task to 286 TSS hj, kr 
From 286 Task to 386 TSS hike 
From 286 Task to Virtual 8086 Mode hiker 
From 386 Task to 286 TSS hike 
From 386 Task to 386 TSS hiker 
From 386 Task to Virtual 8086 Mode hj, kr 


PROCESSOR CONTROL 


HLT = HALT 


MOV = Move to and From Control/Debug/Test Registers 
CRO/CR2/CR3 from register 00001111 00 
Register From CRO-3 00001111 
DRO-3 From Register 00001111 
DR6-7 From Register 00001111 
Register from DR6-7 00001111 
Register from DRO-3 00001111 
TR6-7 from Register 00001111 
Register from TR6-7 00001111 


NOP = No Operation 10010000 


ea | ° 
= [fae ° 
a || 1/8 || 
8 | 18 8 


3 
3 


3 
FS 


| 
Fy 


WAIT = Wait until BUSY # pin is negated 
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PROCESSOR EXTENSION INSTRUCTIONS 


Processor Extension Escape 11011TTT | modLLL f/m 
TTT and LLL bits are opcode 80287/80387 


information for coprocessor. data sheets for 
clock counts 
PREFIX BYTES 
Address Size Prefix 
LOCK = Bus Lock Prefix 11110000 


Operand Size Prefix 01100110 
Segment Override Prefix 
Segment Override Prefix 


cs: 00101110 
Ds: 
00100110 
01100100 
01100101 


00110110 


PROTECTION CONTROL 
ARPL = Adjust Requested Privilege Level 
From Register/Memory 01100011 
LAR = Load Access Rights 
From Register/Memory 00001111 00000010 | modreg r/m 
LGDT = Load Global Descriptor 
Table Register 00001111 00000001 |mod010 r/m 
LIDT = Load Interrupt Descriptor 
Table Register 00001111 00000001 
LLDT = Load Local Descriptor 


Table Register to 
Register/Memory 00001111 | 00000000 | modo10 /m 


LMSW = Load Machine Status Word 
From Register/Memory 00001111 00000001 110 f/m 


LSL = Load Segment Limit 


From Register/Memory 00001111 00000011 | modreg r/m 


Byte-Granular Limit 
Page-Granular Limit 


LTR = Load Task Register 
From Register/Memory 00001111 00000000 | mod001 f/m 
SGDT = Store Global Descriptor 


Table Register 00001111 00000001 |mod000 f/m 


° 
= 
= 

a 


| 
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Table 8-1. 80386 Instruction Set Clock Count Summary (Continued) 


INSTRUCTION FORMAT 


= Store Interrupt Descriptor 
Table Register 00001111 00000001 | mod001 f/m 


= Store Local Descriptor Table Register 


To Register/Memory 00001111 00000000 |mod000 f/ 
= Store Machine 
Status Word 00001111 00000001 


= Store Task Register 
To Register/Memory 00001111 00000000 


=Verify Read Accesss 


Register/Memory 00001111 00000000 
= Verify Write Accesss 00001111 00000000 | mod101 r/m 


INSTRUCTION NOTES FOR TABLE 8-1 


m 
m 


Notes a through c apply to 80386 Real Address Mode only: 

a. This is a Protected Mode instruction. Attempted execution in Real Mode will result in exception 6 (invalid opcode). 

b. Exception 13 (general protection) will occur in Real Mode if a 16-bit or 32-bit operand reference is made that partially or 
fully extends beyond the maximum segment limit, FFFFH. 

c. This instruction may be executed in Real Mode. In Real Mode, its purpose is primarily to initialize the CPU for Protected 
Mode. 


Notes d through g apply to 80386 Real Address Mode and 80386 Protected Virtual Address Mode: 
d. the iAPX 386 uses an early-out multiply algorithm. The actual number of clocks depends on the position of the most 
significant bit in the operand (multiplier). 

Clock counts given are minimum to maximum. To calculate actual clocks use the following formula: 

Actual Clock = if m < > 0 then max ([logo |m|], 3) + 6 clocks: 

if m = 0 then 9 clocks (where m is the multiplier) 

e. An exception may occur, depending on the value of the operand. 
f. LOCK # is automatically asserted, regardless of the presence or absence of the LOCK # prefix. 
g. LOCK # is asserted during descriptor table accesses. 


Notes h through r apply to 80386 Protected Virtual Address Mode only: 

h. Exception 13 (general protection violation) will occur if the memory operand cannot be used due to either a segment limit 
violation or access rights violation. If a stack limit is violated, an exception 12 (stack segment overrun or not present) occurs. 
i. For segment load operations, the CPL, RPL, and DPL must agree with the privilege rules to avoid an exception 13 (general 
protection violation). The segment's descriptor must indicate “present” or exception 11 (CS, DS, ES, FS, GS not present). If 
the SS register is loaded and a stack segment not present is detected, an exception 12 (stack segment overrun or not 
present) occurs. 

j. All segment descriptor accesses in the GDT or LDT made by this instruction will automatically assert LOCK # to maintain 
descriptor integrity in multiprocessor systems. 

k. JMP, CALL, INT, RET and IRET instructions referring to another code segment will cause an exception 13 (general 
protection violation) if an applicable privilege rule is violated. 

|. An exception 13 occurs if CPL is greater than 0 (0 is the most privileged level). 

m. An exception 13 occurs if CPL is greater than IOPL. 

n. The IF bit of the flag register is not updated if CPL is greater than IOPL. The IOPL and VM fields of the flag register are 
updated only if CPL = 0. 

o. The PE bit of the MSW (CRO) cannot be reset by this instruction. Use MOV into CRO if desiring to reset the PE bit. 

p. Any violation of privilege rules as applied to the selector operand do not cause a protection exception; rather, the zero 
flag is cleared. 

q. If the coprocessor’s memory operand violates a segment limit or segment access rights, an exception 13 (general protec- 
tion exception) will occur before the ESC instruction is executed. An exception 12 (stack segment overrun) will occur if the 
stack limit is violated by the operand’s starting address. 

r. The destination of a JMP, CALL, INT, RET or IRET must be in the defined limit of a code segment or an exception 13 
(general protection violation) will occur. 


117 


intel 
8.2 INSTRUCTION ENCODING 


8.2.1 Overview 


All instruction encodings are subsets of the general 
instruction format shown in Figure 8-1. Instructions 
consist of one or two primary opcode bytes, possibly 
an address specifier consisting of the “mod r/m” 
byte and “scaled index” byte, a displacement if re- 
quired, and an immediate data field if required. 


Within the primary opcode or opcodes, smaller en- 
coding fields may be defined. These fields vary ac- 
cording to the class of operation. The fields define 
such information as direction of the operation, size 
of the displacements, register encoding, or sign ex- 
tension. 


Almost all instructions referring to an operand in 
memory have an addressing mode byte following 
the primary opcode bytes(s). This byte, the mod r/m 
byte, specifies the address mode to be used. Certain 


80386 
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encodings of the mod r/m byte indicate a second 
addressing byte, the scale-index-base byte, follows 
the mod r/m byte to fully specify the addressing 
mode. 


Addressing modes can include a displacement im- 
mediately following the mod r/m byte, or scaled in- 
dex byte. If a displacement is present, the possible 
sizes are 8, 16 or 32 bits. 


If the instruction specifies an immediate operand, 
the immediate operand follows any displacement 
bytes. The immediate operand, if specified, is always 
the last field of the instruction. 


Figure 8-1 illustrates several of the fields that can 
appear in an instruction, such as the mod field and 
the r/m field, but the Figure does not show all fields. 
Several smaller fields also appear in certain instruc- 
tions, sometimes within the opcode bytes them- 
selves. Table 8-2 is a complete list of all fields ap- 
pearing in the 80386 instruction set. Further ahead, 
following Table 8-2, are detailed tables for each 
field. 


TTTTTTTT|TTTTTTTT| modTTTr/m| ss index base |d32 | 16 | 8 | none data32 | 16 | 8 | none 


765320 


0.765320 


5 Se! Ne Dobe rib rk TO | OPTS 


“mod r/m” 


byte 


opcode 
(one or two bytes) 
(T represents 
opcode bit.) 


“S.)-b” 


es ac 


register and address 


immediate 
data 
(4, 2, 1 bytes 
or none) 


address 
displacement 
(4, 2, 1 bytes 

or none) 


byte 


mode specifier 


Figure 8-1. General Instruction Format 


Table 8-2. Fields within 80386 Instructions 


Field Name Description Number of Bits 


Specifies if Data is Byte or Full Size (Full Size is either 16 or 32 Bits 
Specifies Direction of Data Operation 
Specifies if an Immediate Data Field Must be Sign-Extended 


reg 
mod r/m 


General Register Specifier 


ss 
index 
base 
sreg 
sreg 
tttn 
or a Condition Negated 


Address Mode Specifier (Effective Address can be a General Register) 
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2 for mod; 
3 forr/m 


Scale Factor for Scaled Index Address Mode 


General Register to be used as Index Register 

General Register to be used as Base Register 

Segment Register Specifier for CS, SS, DS, ES 

Segment Register Specifier for CS, SS, DS, ES, FS, GS 

For Conditional Instructions, Specifies a Condition Asserted 


intel 


8.2.2 32-Bit Extensions of the 
Instruction Set 


With the 80386, the 86/186/286 instruction set is 
extended in two orthogonal directions: 32-bit forms 
of all 16-bit instructions are added to support the 32- 
bit data types, and 32-bit addressing modes are 
made available for all instructions referencing mem- 
ory. This orthogonal instruction set extension is ac- 
complished having a Default (D) bit in the code seg- 
ment descriptor, and by having 2 prefixes to the in- 
struction set. 


Whether the instruction default to operations of 16 
bits or 32 bits depends on the setting of the D bit in 
the code segment descriptor, which gives the de- 
fault length (either 32 bits or 16 bits) for both oper- 
ands and effective addresses when executing that 
code segment. In the Real Address Mode or Virtual 
8086 Mode, no code segment descriptors are used, 
but a D value or 0 is assumed internally by the 
80386 when operating in those modes (for 16-bit de- 
fault sizes compatible with the 8086/80186/80286). 


Two prefixes, the Operand Size Prefix and the Effec- 
tive Address Size Prefix, allow overriding individually 
the Default selection of operand size and effective 
address size. These prefixes may precede any op- 
code bytes and affect only the instruction they pre- 
cede. If necessary, one or both of the prefixes may 
be placed before the opcode bytes. The presence of 
the Operand Size Prefix and the Effective Address 
Prefix will toggle the operand size or the effective 
address size, respectively, to the value ‘‘opposite” 
from the Default setting. For example, if the default 
operand size is for 32-bit data operations, then pres- 
ence of the Operand Size Prefix toggles the instruc- 
tion to 16-bit data operation. As another example, if 
the default effective address size is 16 bits, pres- 
ence of the Effective Address Size prefix toggles the 
instruction to use 32-bit effective address computa- 
tions. 


These 32-bit extensions are available in all 80386 
modes, including the Real Address Mode or the Vir- 
tual 8086 Mode. In these modes the default is al- 
ways 16 bits, so prefixes are needed to specify 32- 
bit operands or addresses. 


Unless specified otherwise, instructions with 8-bit 
and 16-bit operands do not affect the contents of 
the high-order bits of the extended registers. 


8.2.3 Encoding of Instruction Fields 


Within the instruction are several fields indicating 
register selection, addressing mode and so on. The 
exact encoding of these fields are defined immedi- 
ately ahead. 


80386 
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8.2.3.1 ENCODING OF OPERAND LENGTH (w) 
FIELD 


For any given instruction performing a data opera- 
tion, the instruction is executing as a 32-bit operation 
or a 16-bit operation. Within the constraints of the 
operation size, the w field encodes the operand size 
as either one byte or the full operation size, as 
shown in the table below. 


Operand Size 
During 16-Bit 
Data Operations 


Operand Size 
During 32-Bit 
Data Operations 


8.2.3.2 ENCODING OF THE GENERAL 
REGISTER (reg) FIELD 


The general register is specified by the reg field, 
which may appear in the primary opcode bytes, or as 
the reg field of the ‘mod r/m” byte, or as the r/m 
field of the ‘mod r/m”’ byte. 


Encoding of reg Field When w Field 
is not Present in Instruction 


Register Selected | Register Selected 
During 16-Bit During 32-Bit 
Data Operations | Data Operations 


reg Field 


Encoding of reg Field When w Field 
is Present in Instruction 


Register Specified by reg Field 
During 16-Bit Data Operations: 


Function of w Field 


Register Specified by reg Field 
During 32-Bit Data Operations 


Function of w Field 


8.2.3.3 ENCODING OF THE SEGMENT 
REGISTER (sreg) FIELD 


The sreg field in certain instructions is a 2-bit field 
allowing one of the four 80286 segment registers to 
be specified. The sreg field in other instructions is a 
3-bit field, allowing the 80386 FS and GS segment 
registers to be specified. 


2-Bit sreg Field 


Segment 
Register 
Selected 


2-Bit 
sreg Field 


3-Bit sreg Field 


Segment 
Register 
Selected 


ES 
cs 


3-Bit 
sreg Field 


Ss 
DS 
FS 
GS 
do not use 
do not use 
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8.2.3.4 ENCODING OF ADDRESS MODE 


Except for special instructions, such as PUSH or 
POP, where the addressing mode is pre-determined, 
the addressing mode for the current instruction is 
specified by addressing bytes following the primary 
opcode. The primary addressing byte is the ‘mod 
r/m” byte, and a second byte of addressing informa- 
tion, the ‘‘s-i-b” (scaled index) byte, can be speci- 
fied. 


The s-i-b byte (scale-index-base-byte) is specified 
when using 32-bit addressing mode and the “mod 
r/m” byte has r/m = 100 and mod = 00, 01 or 10. 
When the sib byte is present, the 32-bit addressing 
mode is a function of the mod, ss, index, and base 
fields. 


The primary addressing byte, the “mod r/m’’ byte, 
also contains three bits (Shown as TTT in Figure 8-1) 
sometimes used as an extension of the primary op- 
code. The three bits, however, may also be used as 
a register field. 


When calculating an effective address, either 16-bit 
addressing or 32-bit addressing is used. 16-bit ad- 
dressing uses 16-bit address components to calcu- 
late the effective address while 32-bit addressing 
uses 32-bit address components to calculate the ef- 
fective address. When 16-bit addressing is used, the 
“mod r/m”’ byte is interpreted as a 16-bit addressing 
mode specifier. When 32-bit addressing is used, the 
“mod r/m’’ byte is interpreted as a 32-bit addressing 
mode specifier. 


Tables on the following four pages define all encod- 
ings of all 16-bit addressing modes and 32-bit ad- 
dressing modes. 
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Encoding of 16-bit Address Mode with mod r/m Byte 


Effective Address Effective Address 


DS:[BX+ Sl] DS:[BX + SI+d16] 
DS:[BX + DI] DS:[BX + DI+d16] 
SS:[BP + SI] SS:[BP + SI+d16] 
SS:[BP + Di] SS:[BP + DI+ 16] 
DS:[SI] DS:[SI+ 16] 

DS: [DI] DS:[D!+ 416] 
DS:d16 DS:[BX + d16] 
DS:[Bx] SS:[BP + d16] 


DS:[BX + SI+ d8] register—see below 
DS:[BX + DI+ d8] register—see below 
SS:[BP + SI+ d8] register—see below 
SS:[BP + DI+ d8] register—see below 
DS:[SI+ d8] register—see below 
DS: [DI + d8] register—see below 
DS:[BX + d8] register—see below 
SS:[BP + d8] register—see below 


Register Specified by r/m 
During 16-Bit Data Operations 
med ite Function of w Field 


Register Specified by r/m 
During 32-Bit Data Operations 
Function of w Field 
AL 
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Encoding of 32-bit Address Mode with mod r/m Byte (no s-i-b byte present) 


Effective Address Effective Address 


DS: [EBX + ESI + d32] 
DS: [EBX + EDI + d32] 
SS:[EBP + ESI + d32] 
SS:[EBP + EDI + d32] 
s-i-b is present 
DS:[EDI + d32] 

DS: [EBX + d32] 
SS:[EBP + d32] 


register—see below 


register—see below 01 001 DS:[EBX + EDI + d8] 
register—see below 01010 SS:[EBP + ESI+ d8] 
register—see below 01011 SS:[EBP + EDI + d8] 
register—see below 01 100 s-i-b is present 
register—see below 01 101 DS: [EDI + d8] 


register—see below 
register—see below 


DS:[EBX + ESI] 
DS:[EBX + EDI] 
SS:[EBP + ESI] 
SS:[EBP + EDI] 
s-i-b is present 
DS:[EDI] 
DS:d32 
DS: [EBX] 


DS:[EBX + ESI + d8] 


DS: [EBX + d8] 
SS:[EBP + d8] 


Register Specified by reg or r/m 
During 16-Bit Data Operations 


wied vive Function of w Field 
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Encoding of 32-bit Address Mode (mod r/m and s-i-b byte present) 


Effective Address 


DS:[EAX + (scaled index)] 
DS:[ECX + (scaled index)] 
DS:[EDX + (scaled index)] 
DS: [EBX + (scaled index)] 
SS:[EAX + (scaled index)] 
DS:[d32 + (scaled index)] 
DS:[ESI-+ (scaled index)] 
DS:[EDI + (scaled index)] 


DS:[EAX + (scaled index) + d8] 
DS:[ECX + (scaled index) + d8] 
DS:[EDX + (scaled index) + d8] 


DS:[EBX + (scaled index) + d8] 
SS:[ESP + (scaled index) + d8] 
SS:[EBP + (scaled index) + d8] 
DS:[ESI-+ (scaled index) + d8] 
DS:[EDI-+ (scaled index) + d8] 


DS:[EAX + (scaled index) + d32] 
DS:[ECX + (scaled index) + d32] 
DS: [EDX + (scaled index) + d32] 
DS: [EBX + (scaled index) + d32] 
SS:[EAX + (scaled index) + d32] 
SS:[EBP + (scaled index) + d32] 
DS:[ESI + (scaled index) + d32] 

DS:[EDI + (scaled index) + d32] 
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| ss | ScaleFactor | 
00 


01 
10 
11 


| index | __index Register 


EAX 
ECX 
EDX 
EBX 
No Index Reg 
EBP 
ESI 
EDI 


8.2.3.5 ENCODING OF OPERATION DIRECTION 
(d) FIELD 


In many two-operand instructions the d field is pres- 
ent to indicate which operand is considered the 
source and which is the destination. 


ld | Direction of Operation 


Register/Memory <- - Register 
“reg” Field Indicates Source Operand; 
“mod r/m”’ or “mod ss index base”’ Indicates 


Destination Operand 


Register <- - Register/Memory 

“reg” Field Indicates Destination Operand; 
“mod r/m” or ‘‘mod ss index base” Indicates 
Source Operand 


8.2.3.6 ENCODING OF SIGN-EXTEND (s) FIELD 


The s field occurs primarily to instructions with im- 
mediate data fields. The s field has an effect only if 
the size of the immediate data is 8 bits and is being 
placed in a 16-bit or 32-bit destination. 


} Effect on Effect on 
Immediate Data8& Immediate Data 16|32) 


Sign-Extend Data8 to Fill 
16-Bit or 32-Bit Destination 


8.2.3.7 ENCODING OF CONDITIONAL TEST 
(tttn) FIELD 


For the conditional instructions (conditional jumps 
and set on condition), tttn is encoded with n indicat- 
ing to use the condition (n=0) or its negation (n= 1), 
and ttt giving the condition to test. 
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Below/Not Above or Equal 
Not Below/Above or Equal 
Equal/Zero 

Not Equal/Not Zero 

Below or Equal/Not Above 


Not Below or Equal/Above 

Sign 

Not Sign 

Parity/Parity Even 

Not Parity/Parity Odd 

Less Than/Not Greater or Equal 
Not Less Than/Greater or Equal 


8.2.3.8 ENCODING OF CONTROL OR DEBUG 
OR TEST REGISTER (eee) FIELD 


For the loading and storing of the Control, Debug 
and Test registers. 


When Interpreted as Control Register Field 


000 CRO 
010 CR2 
011 CR3 


Do not use any other encoding 
When Interpreted as Debug Register Field 


Do not use any other encoding 
When Interpreted as Test Register Field 


110 TR6 
111 TR7 


Do not use any other encoding 
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intel Corp. 

7071 Orchard Lake Road 
Suite 100 

West Bioomfieid 48033 
Tel: (313) 851-8096 


MINNESOTA 
intel Corp. 
3500 W. 80th Street 
Suite 360 


55431 
Tel: (612) 835-6722 
TWX: 910-576-2867 
MISSOURI 
intel_ Corp. 
303 Earth City Expressway 
Suite 131 


Tet Fer (ore) anc 3311990 


we 87112 


NEW YORK 


11788 
Ter (Sie) 231-3300 


TWX: 510-227-6236 


intel Corp. 
Suite 2B Hollowbrook Park 


Tet or) 297-6161 
TWX: 510-248-0060 


inte! Corp.* 

211 White Spruce Boulevard 
Rochester 14623 

Tel: (716) 424-1050 

TWX: 510-253-7391 


red 
ie 
1 
Tel: (315) 463-8592 
TWX: 710-541-0554 


T-Squared 

7353. Pittstord-Victor Road 
Victor 14564 

Tel: (716) 924-9101 

TWX: 510-254-8542 


2700 “Wyeit! Road 
Suite 102 


Raleigh 27607 
Tet: (919) 781-8022 
OHIO 


intel_Corp.* 

6500 Poe Avenue 
Dayton 45414 

Tel. (513) 890-5350 
TWX: 810-450-2528 


[la 
Brainard Bldg. No. 300 


Gevetand fetes 


Tel: (216) 464-2736 
TWX: 810-427-9298 


OKLAHOMA 


Intel_ Corp. 

4157 S. Harvard Avenue 
Suite 123 

Tulsa 74135 

Tet (918) 749-8688 


intel Corp. 
10700 S.W. Beaverton 
Hiledale, Highway 


Suite 2: 

97005 
Tel: (503) 641-8086 
WX: 910-467-8741 


PENNSYLVANIA 


inte! Corp. 

1513 Cedar Ciiff Drive 
Camphill 17011 

Tel: (717) 737-5035 
Intet * 

Se Gate ar 
"ort 

Tel: (25) 641-1000 
TWX: 510-661-2077 


intel Corp.* 

400 Penn Center Boulevard 
Suite 610 

Pittsburgh 15235 

Tel: (412) 823-4970 


Willow Grove 19090 
Tel; (215) 657-5600 


Intel Microprocessor 
South Industrial Park 
Las Piedras 00671 

Tel: (809) 733-3030 


TEXAS 


Intel Corp. 

313 E_ Anderson Lane 
Suite 314 

Austin 78752 

Tet (512) 454-3628 


intel Corp.* 

12300 Ford Road 
Suite 380 

Dallas 75234 

Tel: (214) 241-8087 
TWX: 910-860-5617 


imei Corp. 
7322 SW. Freeway 


Tel: (713) 988-8086 
TWX: 910-881-2490 


-heagen Digital Systems Corp. 
5 Sovereign 


Houston 77036 

Tek (713)988-9421 
UTAH 

intel 

$201 eel Street 
Suite ee 

Murray 

Tel: ( ) "39.2081 
VIRGINIA 

intei_ Corp. 

1603 Santa Rosa Road 
Suite 109 

Richmond 23288 

Tel: (804) 282-5668 
WASHINGTON 

Intel. Corp. 

110 110th Avenue N.E. 
Suite 510 


Tet: (206) 453-8086 
TWX: 910-443-3002 


Spokane 99206 

Tet. (509) 928-8086 
WISCONSIN 

Intel Corp. 

450 N. Sunnysiope Road 
Suite 130 

Chancellory_ Park | 


Brookfield 53005 
Tek (414) 784-8087 


CANADA 


BRITISH COLUMBIA 

imei Semiconductor of Canada, Lid. 
301-2245 W. Broadway 

Vancouver V6K 2E4 

Tei (604) 738-6522 


ONTARIO 


ae ence (Ol Canes, | Lie 
2650 Queensview 


a K2B 8HE 
Tet (613) B27 
TELEX: 053-4115 


Intel Semiconductor of Canada, Ltd 

190 Attwell Drive 

Suite 500 

Rexdale MOW 6H8 

Tet (416) 675-2105 

TELEX: 06983574 

QUEBEC 

intel Semiconductor of Canada, Ltd. 
Bivd, 


Tel: (514) 694-9130 
TWX: 514-694-9134 


“Field Application Location 


ALABAMA 

Arrow Electronics, inc. 

1015 Henderson Road 
Huntsville 35805 

Tel: (205) 837-6955 
tHamilton/Avnet Electronics 
4812 Commercial Drive N.W 


Huntsville 35805 
Tel; (205) 837-7210 
TWX: 810-726-2162 


Electronics 
4825 
Huntsville 
Tel: (205) 837-9300 
TWX. 810-726-2197 


tHamitton/Avnet Electronics 
505 S. Madison Drive 

Tempe 85281 

Tel Tal "2 29 231- Vit 


Kieruitf_ Electronics 
4134 E Wood Street 


Tet: (602) 437-0750 
TWX: 910-951-1550 


Wyle Distribution Group 

17855 N_ Black Canyon Highway 
Phoenix 85023 

Tel (602) 866-2888 


CALIFORNIA 
Arrow Electronics, Inc. 


Chatsworth 
Tel; (818) 701-7500 
TWX: 910-493-2086 


Sunnyve 
Tel: (408) 745-6600 
TWX: 910-339-9371 


Arrow Electronics, Inc. 
2961 Dow Avenue 
Tustin 92680 

Tel: (714) 836-5422 
TWX: 910-595-2860 


tAvnet Electronics 
350 McCormick Avenue 
Costa Mesa 92626 
Tet yh 754-6051 
TWX: 910-595-1928 


Hamitton/Avnet Electronics 
1175 Bordeaux Drive 


vale 94086 
Tel: (408) 743-3300 
TWX: 910-339-9332 


inerman/ Arm Prange 


Chatsworth 91311 
Tel: (818) 700-6271 
TWX: 910-494-2207 


tHamilton/Avnet Electronics 
4103 Northgate Boulevard 
Sacramento 95834 
Tel; (916) 920-3150 


Hamilton/Avnet Electronics 
3002 G Street 

Ontario 91311 

Tel: (714) 989-9411 
Hamilton/Avnet Electronics 
19515 So. “Vermont Avenue 
Torrance 90502 

Tet: (213) 615-3909 

TWX: 910-349-6263 


Culver City 2023 
Tel: 219. 558-2458 
TWX: 910-340-6364 


Hamilton Electro Sales 
3170 Pullman Street 
Mesa 


Costa 92626 
Tet hy 641-4150 
TWX 910-595-2638 


DOMESTIC DISTRIBUTORS 


Tel: (818) 700-6500 


Kierulff Electronics 
10824 Hope Street 


90430 
(714) 220-6300 


Tel: (408) 947-3471 
TWX: 910-379-6430 


Kierulff_ Electronics, inc. 
14101 Franklin Avenue 


Tustin 92680 
Tel: (714) 731-5711 
TWX: 910-595-2599 


‘tKierulff Electronics, Inc. 
5650 Jilison Street 


Commerce 90040 
Tet: (213) 725-0325 
TWX: 910-580-3666 


350 Agoura en 
treet 

Calabasas 91302 

Tet (818) 880-9000 

TWX: 818-372-0232 


a 


124 
Cae 228-8100 
0.348. 7140 of 7111 


Irvine 92714 
Tet (714) 843-9953 
TWX. 910-595-1572 


Distribution Group 

1 Sun Center Drive 
Rancho Cordova 95670 
Tel: (916) 638-5282 


Sar 
Tel: (619) 565-9171 
TWX: 910-335-1590 


t —— Group 
$080" dower Avenue 
Santa Clara 95051 

Tet: (408) 727-2500 
TWX: 910-338-0296 


Wyle Military 
17810 Teller Avenue 


Irvine 92750 
Tet: (714) 851-9958 
TWX; 310-371-9127 


ws ‘Systems 

7382 Lampson Avenue 
Garden Grove 92641 
Tel: (714) 851.9953 
TWX: 910-595-2642 


COLORADO 


‘tWyle Distribution Group 
451 E 124th Avenue 
Thornton 80241 

Tel: (303) 457-9953 
TWX: 910-936-0770 


Tel: (303) 740-1017 
TWX: 910-935-0787 


CONNECTICUT 
tArrow Electronics. Inc. 
12 Beaumont Road 
we 06492 

Tel: ( 265-7741 
TWX: 710-476-0162 


Eermerce naustan Pak 

Industrial Park 

ata 797-2800 
110-456-9974 

tPioneer Northeast Electronics 

112 Main Street 


Norwalk 06851 
ie (203) 853-1515 
468-3373 


Deerfield 
Tel. (305) 429-8200 
TWX: 510-955-9456 


tArrow Electronics. inc 
1001 N.W. 62nd Street 
Suite 108 

Ft Lauderdale 33309 
Tet. (305) 776-7790 
TWX: 510-955-9456 


TWX: 510-959-6337 
tHamilton/Avnet Electronics 


Tel: (305) 971-2900 
TWX: 510-956-3097 


Tek (813) 576-3930 
TWX 810-863-0374 


Hamitton/Avnet Electronics 
Boulevard 


6947 
wi 32 


Tek: ¢ ee 
TWX: 810-853-0322 
tPioneer Electronics 
221 N, Lake Boulevard 
Alta Monte 32701 
}0-853-0284 
tPioneer Electronics 
674 S. Military Trail 
Deerfield Beach 33442 
Tet: (305) 428-8877 
TWX 510-955-9653 


TWX: Ore 766-0439 


Hamilton/Avnet Electronics 
5825 0. Peachtree Corners 
Norcross 30092 

Tet: (404) 447-7500 

TWX. 810-766-0432 


Nore 30092 
Tel: (404) 448-1711 
TWX: 810-766-4515 


ILLINOIS 
tArrow Electronics, inc 
2000 Street 


Bensenville 106 
Tet: (312) 860-7780 
TWX: 910-227-0060 


G 
Tel: (312) 437- 
TWX: 910-222-1834 


INDIANA 
tArrow Electronics, Inc. 
2495 Directors Flow, Suite H 
4624) 
, 43-9353 
810-341-3119 
Hamilton/Avnet Electronics 
485 Gradie oe 
Carme) 46032 
Tel: lho 
260-3966 


indianapolis 46250 
Tet: (317) 849-7300 
TWX: 810-260-1794 


Tel. (301) 995-0003 


Columbia 2’ 
Tel (301) 995-3500 
TWX: 710-862-1861 


tMesa T 

16021 Industrial Drive 
Gaithersburg 20877 

Tel: (301 18-4350 
TWX: 710-828-9702 


tPioneer Electronics 
9100 Gaither Road 


Far sen) B4B.0710 
fet: (301 "i 
TWX: 71 Ss 


Woburn 01801 
Tel: (617) 933-8130 
TWX: 710-393-6770 


Tel: (617) 935-9700 
TWX: 710-393-0382 


(617) 863-1200 


Ann 
Tel: (313) 971-8220 
TWX: 810-223-6020 


tHamilion/Avnet Electronics 
proud niga Road 


tere roy 352-4700 
TWX. 810-242-8775 


Hamitton/Avnet Electronics 
ae 7 Street S.E. 
pace 

Grand Rapids 49508 
Tel: (616) 243-8805 
TWX: 810-273-6921 


13485 Stamford 


Livonia 50 
Tel: (313) 525-1800 
TWX: 810-242-3271 


tArrow Electronics, inc. 
5230 W. 73rd Street 


Edina 55435 
Tel: (612) 830-1800 
TWX: 910-576-3125 


Hamitton/Avnet Electronics 
10300 Bren Road East 


Minnetonka 55343 
Tet: (612) 932-0600 
TWX: (910) 576-2720 


10203 Bren Road East 
Minnetonka 55343 


Tel: (612) 935-5444 
TWX: 910-576-2738 
MISSOURI 


Arrow Electronics, Inc. 
2380 Schuetz 
St. Louis 63141 


Tel: (314) 567-6888 
TWX: 910-764-0882 


Earth at 
Tel: (314) 344-1200 
TWX. 910-762-0684 


tMicrocomputer System Technical Demonstrator Centers 


Mi 

Tel: (603) 668-6968 

TWX: 710-220-1684 

Hamilton/Avnet Electronics 

444 E Industrial Drive 

Manchester 03104 

Tel: (603) 624-9400 

NEW JERSEY 

Ee Electronics, inc 
Lincoin East 

Marton 

Tel; (609) 596-8000 

TWX: 710-897-0829 


Tel: oe a 575-5300 
}-2206 


tHamilton/Avnet Electronics 
1 Keystone Avenue 


Hill 08003 
Tot (609) 424.0110 
TWX. 710-940-0262 
tHamiton/Avnet Electronics 
10 industrial 
Fairfield 07006 
Tot, (201) §75-3390 
710-734-4388 


ease Northeast Electronics 
po Fe pos 46 


rook 07058 
rea (201) 575-3510 
TWX: 710-734-4382 
TMTI S) Sales 
385 pote 46 W 
Fairfield 07006 
Tel: (201) 227-5552 
NEW MEXICO 

Electronics inc, 
fo30 30. Cochit SE 

87123 


que 
Tel: (505) 292-3360 
TWX: 910-989-1151 


Tei: (505) 765-1500 
TWX. 


(516) 694-6800 
TWX: 510-224-6126 


tArrow Electronics, Inc. 


3375 Brighton-Henrietia Townline Road 
14623 


Rochester 
Tel: (716) 427-0300 
TWX: 510-253-4766 


Arrow Electronics, Inc 
7705 Orive 


Liverpool 1: 
Tet. (315) ee — 
TWX: 7% 


re {si 2 000 
$10-227-6623 


Rochester 1 
Tet: Twit’ athone: 75-310 30 


Hamitton/Avnet Electronics 
= Twin bw) Orive 

Tet (315) 437-2641 

TWX. 710-541-1560 
tHamitton/Avnet Electronics 
933 Motor Parkway 


y 
11788 
Tel: ta 231-9800 
TWX: 510-224-6166 
tPioneer 


DOMESTIC DISTRIBUTORS 


NEW YORK (Cont'd) 


Pioneer Northeast 

60 Crossway Park West 
Woodbury, ro island 11797 
Tel; (516) 921-6700 

TWX: 510-221-2184 


Tet (716) 381-7070 
TWX: 510-253-7001 


tMT! Systems Sales 
38 Harbor Park Drive 
P.O. Box 271 

a 
TWX: 510-22: 3.0886 
NORTH CAROLINA 


Arrow Electronics, inc. 
5240 creencary Road 


Tel. 519) "36-3132 
TWX. 510-928-1856 


tHamitton/Avnet Electronics 
3510 is Forest Drive 
2 


Tel 9) 678-0819 
TWX: 510-928-1836 


Pioneer Electronics 

9801 A-Southern Pine Boulevard 
Charlotte 28210 

Tel: (704) 524-8188 

TWX, 810-621-0366 


Centerville 45459 
Tet: (513) 435-5563 
TWX: 8 


Solon 
Tel; (216) 248-3990 
TWX. 810-427-9409 


Pereen/ inet Electronics 
is Senate Drive 


ion 45459 
Tel: (513) 433-0610 
TWX: 810-450-2531 


Warrensville 
Tet: (216) 831-3% 
TWX: 810-427-9452 


tPioneer Electronics 
4433 

45424 
Tel: (513) 236-9900 
TWX. 810-459-1622 


‘Pioneer Electronics 
Te00 G in prem 
Cleveland 44 


Tei (216) 387-3600 
TWX: 810-422-2211 


OKLAHOMA 


Arrow Electronics, inc 
4719 S| Memorial 
Tulsa 74145 

Tel (918) 665-7700 
OREGON 
tAlmac Electronics Corporation 
1885 NW. aioe Place 
Beaverton 97006 


Tel: (503) 
TWX: o10-467.8943) 


TWX: 910-455-8179 


we Distribution Group 

5250 N.E Elam Young Parkway 
Suite 600 

Hillsboro 97124 

Tel: (503) 640-6000 

TWX: 910-460-2203 


PENNSYLVANIA 


Arrow Electronics, Inc. 
650 Seco Road 


Monroeville 15146 
Tet (412) 856-7000 


PENNSYLVANIA (Cont'd) 


Pioneer Electronics 
259 Kappa Drive 
Pittsburgh 15238 
Tel. (412) 782-2300 
TWX: 710-795-3122 


tPioneer Electronics 


Tel. (215) 674-4000 
TWX 510-665-6778 


Tel: (214) 380-6464 
TWX: 910-860-5377, 


tArrow Electronics, inc. 
10899 Kinghurst 

Suite 100 

Houston 77099 

Tel: (713) 530-4700 
TWX: 910-880-4439 


Arrow Electronics. inc. 
10125 
Austin 


787! 
(S12) 835-4180 
TWX: 910-874-1348 


Tel: (512) 837-8911 
TWX: 910-874-1319 


'Hamilton/Avnet Electronics 
111 W. Walnut Hill Lane 


Irving 75062 
Tel: (214) 659-4100 
TWX. 910-860-5929 


tHamilton/Avnet Electronics 
8750 West Park 

Hosuton 77063 

Tet: (713) 780-1771 

TWX: 91 11-5523. 


Pioneer Electronics 
9901 Burnet Road 
Austin 78758 

Tel: (512) 835-4000 
TWX: 910-874-1323 


Pioneer Electronics 


13710 

T 214). 386-7300 
et 

TWX. 310-880-556 
Pioneer Electronics 
5853 Point West Drive 
Houston 77036 

Tel: (713) 988-5555 
TWX: 91 1606 
UTAH 


tHamilton/Avnet_ Electronics 
1585 West 2100 South 
Sat Lake City 84119 

Tel. (801) 972-2800 

TWX: 910-925-4018 


Distributon Group 
ee oan ae Unt B 


Lake City 84104 
Tet: (801) 974-9953 


WASHINGTON 
tAlmac Electronics 
14360 SE. Eastgate 
Bellevue 98007 


Tel; (206) 643-9992 
TWX: 910-444-2067 


Arrow Electronics, inc 
14320 NE 21st Street 
Bellevue 98007 

Tel: (206) 643-4800 
TWX: 910-444-2017 
Hamitton/Avnet Electronics 
14212 NE 2ist Street 
Tel: (206) 453-5874 
TWX: 911 13-2469 


Tel: (414) 764-6600 
TWX. 910-262-1193 


WISCONSIN (Cont'd) 
tHamilton/Avnet Electronics 
2975 Mooriand Road 
New Berlin 53151 

Tel: (414) 784-4510 

TWX, 910-262-1182 


CANADA 
ALBERTA 


Hamilton/Avnet Electronics 
2816 oat a NE 


Tet ( 2 30-3686 
TWX Osee ea? 


Zentronics 


Bay No. 1 

3300 14th Avenue NE 
Fatdos) 272-001 
BRITISH COLUMBIA 
Hamilton/Avnet Electronics 


malay VSM 323 
Tet (604) 272-4242 


Zentronics 
1108-11400 

Richmond V6X 172 
Tel: (604) 273-5575 
TWX: 04-5077-89 


MANITOBA 


Zentronics 
590 Berry Street 


bil R3H OS1 
208) 775-8661 


Downsview 
Tel: (416) 661-0220 
TELEX: 06-218213 


Arrow Electronics Inc. 
148 Colonnade Road 
Nepean K2E 7J5 

Tel: (613) 226-6903 


tHamilton/Avnet Electronics 
6845 Rexwood Road 
Units G & H = 

Lav 
Yee alee er? vag 
TWX: 610-492-8867 


THamitton/Avnet Electronics 
210 Colonnade 


Nepean K2E 71S 
Tel: (613) 226-1700 
TWX: 05-349-71 


tZentronics 

8 Tilbury Court 
Brampton L6T 3T4 
Tel; (416) 451-9600 
TWX: 06-976-78 


‘entronics 
564/10 Weber Street North 
Waterloo N2U 5C6 
Tel. (519) 884-5700 


Nepean K2E 7K1 
<. 1). mae 


QUEBEC 


Arrow Electronics inc. 
4050 am Talon Quest 


Montreal H4P_1Wt 
Tel ig Re 
TELEX: 25596 
Arrow Electronics inc. 
909 Charest Bivd. 


Quebec 61N 269 
Tel. (418) 687-4231 
TLX: 05-13388 


seem pcre 

‘a 

St Laurent nas Pe 
(514) 335-1000 

TWX: 610-421-3731 


Zentronics 

505 Locke Street 
St Laurent HAT 1X7 
Tet: (514) 735-5361 
TWX: 05-827-535 


tMicrocomputer System Technical Demonstrator Centers 


CALIFORNIA 


Intel_ Corp. 

21515 Vanowen 
Suite 116 

Ca Park 91303 
Tel; (818) 704-8500 


intel Corp. 
2250 E. Imperial Way 
Suite 218 


i] 90245 
Tet (213) 640-6040 


Tel: (415) 968-8211 
TWX. 910-339-9279 
910-338-0255 


Intel_ Corp. 

2000 E 4th Street 
Suite 110 

Santa Ana 92705 

Tel. (714) 835-5577 
TWX 910-595-2475 


intel Corp. 
4350 Execute Drive 
Suite 150 

92121 


San 
Tet: (619) 452-5880 


Tel: (303) 321-8086 
TWX: 910-931-2289 


(CONNECTICUT 


intel 

26 Mill Road 
06811 

Tet: (203) 748-3130 

FLORIDA 


intel cop 

1500 N 62nd Street 
Suite 104 

Ft Lauderdale 33309 
Tel: (305) 771-0600 
TWX: 510-956-9407 


DOMESTIC SERVICE OFFICES 


FLORIDA (Cont'd) 

Intel Corp. 

242 N. Westmonte 
Suite 105 

Altamonte Springs 32714 
Tel: (305) 869-5588 
GEORGIA 


intel Corp. 
3280 Pointe Parkway 
Suite 200 


Norcross 30092 
Tel (404) 441-1171 


Schaumburg 60194 
Tel (312) 310-8034 
Dispatch: (312) 310-1803 


KANSAS 
intel Corp. 
8400 W 110th Street 
Suite 170 


Overland Park 66210 
Tet (913) 642-8060 


intel Corp. 

5th Floor Product Service 
7833 Walker Drive 
Greenbelt 20771 

Tel: (301) 441-1820 


intel Corp. 

27 Industrial Avenue 
Cheimstord 01824 
Tet: (617) 256-1800 
TWX. 710-343-6333 


intel Corp. 

7071 Orchard Lake Road 
Suite 100 

West Bloomfield 48033 
Tel: (313) 851-8905 


intel_ Corp. 

4203 Earth City Expressway 
Suite 143 

Earth City 63045 

Tel: (314) 291-2015 


Ime! Corp. 

385 Sylvan Avenue 
Englewood Cliffs 07632 
Tei. (201) 567-0820 
TWX. 710-991-8593 


Edison 08817 
Tet: (201) 225-3000 


NORTH CAROLINA 


Intel_ Corp. 
2306 W. Meadowview Road 
Suite 206 

Greensboro 27407 

Tel: (919) 294-1541 


OHIO 


Intel Corp 
Chagnin-Brainard Bldg 
Suite 305 

28001 CI nn Boulevard 
Cleveland 44122 

Tel: (216) 464-6915 
TWX. 810-427-9298 


Dayten 45414 
Tel (513) 890-5350 


intet_ Corp. 

10700 SW. Beaverton-Hilisdaie 
Highway 

Suite 22 

Beaverton 97005 


Tet (503) 641-8086 
TWX: 910-467-8741 


OREGON (Cont'd) 


$200 NE, Elam ¥: Parkway 
tam y 

Hillsboro 97123 

Tel (503) 681-8080 


PENNSYLVANIA 


intel Corp. 

201 Penn Center Boulevard 
Suite 301 W 

Pittsburgh 15235 

Tet: (313) 354-1540 


TEXAS 


Intel Corp. 

313 E_ Anderson Lane 
Suite 314 

Austin 78752 

Tel: (512)454-3628 
TWX. 910-874-1347 


intel Corp. 

12300 Ford Road 
Suite 380 

Dallas 75234 

Tel. (214) 241-8087 
TWX: 910-860-5617 


WASHINGTON 

intel Corp. 

110 110th Avenue N.E 
Suite 510 


Tel: 1-800-525-5560 
TWX: 910-443-3002 


Intel Corp. 

450 N. Sunnysiope Road 
Suite 130 

Brooktieid 53005 

Tel (414) 784-8087 


BELGIUM 
intel Corporation S.A 


Parc Seny 
Rue du Rroulin a Papier 51 


3 Brussels 
Tet _(02)661 07 11 
TELEX: 24814 


Intel Denmark A/S* 
Glenteve; 6! - 31d Floor 


Copenhagen 
Tet (01) 19 80 33 
TELEX 19567 


FINLAND 
imei Finland OY 
2 
SF-00390 Helsingfors 39 


Tel: (90) 544 644 
TELEX: 123 332 


TELEX: 699016 


EUROPEAN SALES OFFICES 


FRANCE (Cont'd) 


intel Corporation, S.A R.L 
immeuble BBC 

4 Quai des Etroits 
69005 Lyon 

Tet (7) 842 40 89 
TELEX: 305153 


WEST GERMANY 


intel Semiconductor GmbH* 
Seidistrasse 27 

0-8000 Munchen 2 

Tet (89) 53891 

TELEX: 05-23177 INTL D 


Intel. Semiconductor GmbH* 
Mainzerstrasse 75 

D-6200 Wiesbaden 1 

Tet (6121) 70 08 74 
TELEX: 04168183 INTW D 


Intel Semiconductor GmbH 
Bruckstrasse 61 

pa Fellbach 

tutigart 

Tel: (711) 58 00 82 
TELEX: 7254826 INTS D 


‘el (51) 34 40 81 
TELEX: 923625 INTH D 


Intel Semiconductors Lid.* 
Atidim Industrial Park 


PO Box 43202 
Tel Av 61430 
Tel 3-491099 
Telex: 371215 


ITALY 
intei Corporation taka Spa 


20094 go 
Tel (02) 824 00 06 
TELEX 315183 INTMIL 


Tet: (10) 21 23 77 
TELEX: 22283 


NORWAY 


intel Norway A/S 
PO. Box 92 
Hvamveien 4 
N-2013 


(2) 742 420 
TELEX 18018 


Intel Iberia 
Calle abl 26 
Madrid 


Tet Gay 1410 40 04 
TELEX: 46880 


SWEDEN 
Intel Sweden A.B.* 


Tet: (08) 734 01 00 
TELEX: 12261 


Intel Semiconductor A.G.* 
He cap startmed 7 

81 Copan 4 postiach 
CH-8065 21 

Tet (01) 829 29 77 
TELEX: 57989 ICH CH 


intel Corporation (U.K.) Lid." 
Pipers Way 

Swindon, Wiltshire SN3 1RJ 
Tet (0793) 488 388 

TELEX: 444447 INT SWN 


“Field Application Location 


EUROPEAN DISTRIBUTORS/REPRESENTATIVES 


Bacher Elektronische Geraete GmbH 
Rotenm 26 


A 1120 Wien 
Tet (222) 83 56 46 
TELEX: 11832 BASAT A 


W. Moor GmbH 
vii 


A-1150 Wien 
Tel: 222-85 86 46 


Ineico SA. 
Ave. des Croix de Guerre 94 


1120 Brussels 

Tel: (021) 216 01 60 
LEX: 25441 

DENMARK 


iTT MultiKomponent A/S 
Naverland 29 


OK-2600 Gloskrup 
Tel 8 45 66 45 
TX: 33355 
FINLAND 
Fintronic_ AB 
Ikonkalu 24 A 
SF-00210 Helsinki 21 


Tel: (0) 692 60 22 
TELEX: 124 224 Ftron SF 


Tel " oo ye 78 
TELEX: F691700 


Tot Ad = an 00 


ia Tours" Aarveres 
Avenue Laurent Cely 


“92606-Asnieres 
te ) ane 62 40 


WEST GERMANY 
Electronic 2000 Yorriebs AG 
tal ruberrir 1 

5.8080 Munich 82 

et: (89) 42 00 10 

TELEX 522561 EEC D 


Tel: (06434) 231 
TELEX: 484426 JERM O 


CES Computer Electronics Systems 
Grol 


o 2359 2380" Renaieat-Ut ‘Ulzburg 


Tel: (04193) 4026 
TELEX: 2180260 


Maneasvanse. 18 

asse 8 

D-8000 Munich 

Tel: (89) 57 30 eh 

TELEX: 5213189 
Vertrieds 

Planck Strasse 1-3 

0-6072 Dreieich 

Tel: (6103) 33564 

TELEX: 417983 

IRELAND 


Sleaguny oe Par 


Co. in 
Tel: (1) 85 62 
TELEX: 31584 


Tel: (3) 47 51 51 
TELEX: 33638 


ITALY 


Electra 3S S.P.A. 
Viale Elvezia, 18 


Milano 
Tel: (2) 34 97 51 
TELEX: 332332 


intesi 
Milanotiori Pal. E/5 
20090 Assago 


Milano 
Tet: (2) 82470 
TELEX: 311351 


NETHERLANDS 
Srieb] & einen 
EO" 43220 


2544 EN’s Gravenhage 
Tet: _31 (70) 210.101 
TELEX: 31528 

NORWAY 


Nordisk Elektronic (Norge) A/S 
cones a. 122 


1364 


Tel: (2) 846 210 
TELEX: 17546 


(9) 34 
Teiek e382 Bheks.? 


interface S.A. 
Os pomoas Tebre 12 


4 Barcelona 
9 ef) ne 60 11 
TELEX: 51508 

Miguel noe! 21, 6 Piso 
Madrid 10 

Tel: (34) 14 1954 00 
TELEX: 27461 


Diode 

Rete Ee 8 
28020 Madrid 

Tel: 455 36 86 
TELEX; 42148 


$-10221 
Tel: (08) 541 080 
TELEX: 10135 


Nordisk Electronik AB 
Box 1409 ‘ 


171 27 
Tel: (08), bane 97 70 
TELEX: 


SWITZERLAND 
Industrade AG 


Tet (01) 830 50 40 


Tel: (0734) 61031 
TELEX: 848215 


Comway Microsystems Lid. 
Market Street 
UK-Bracknell, Berkshire 
Tel 44 a $8333 
TELEX: 1 


Sevenoaks, 
Tel: (0732) 450144 
TELEX: 95142 
MEDL 
East Lane Road 
North Wem 
7PP 
eae sent 
Rapic Sues Lid. 
Rapid House/Denmark St 
igh HPI! 2ER 
Png £.¥ 27 
YUGOSLAVIA 
H.R. Microelectronics Enterprises 
P.O. Box 5604 
Jose, California 95150 
Tel: 408/978-8000 
TELEX: 278-559 


Crows Nest, NSW, 2065 
Tel: _011-61-2-957-; sa 
TELEX: 790-2009 

FAX: 011-61-2- ee 2744 


CHINA 

Intel PRC Corporation 
15/F, Office 1, Citic 

Jian Guo Men Wai Avenue 
Beijing, PRC 

HONG KONG 


1 Conneugie 
Tet: 011-852-5-215-311 


TWX: 60410 ITLHK 


INTERNATIONAL SALES OFFICES 


omeshin 

eae L opateiaccld as 
‘tsugi, Kanagawa 
Tel. 0462: 235511 
Intel Japan K.K.* 
1-8889 Fuchu-cho 
Fuchu-shi, 1 183 
Tet: 0423-60-7871 


intel Japan K.K* 
Bldg. Kumagaya 
268 Hon-cho 


kK . Saitama 360 
Tet 0405:24-6871 


Ryokuchi-Station Bidg 
2-4-1 Terauchi 


Toyonaka, Osaka 
Tel: 06-863-1091 


JAPAN (Cont'd) 


Intel Japan K.K 
Shinmaru Bidg. 

1-5-1, Marunouchi 
Chiyoda-ku, Tokyo 100 
Tel: 03-201-3621 


Setagaya-ku, Tokyo 154 
Tel: 03-426-2231 


Kawasaki- 
Tet 044-733-7011 


Intel Japan KK 
Mishima Tokyo-Kaijo Bldg 
1-1. Shibahon-c! 

Mishima-shi 

Shizuoka-Ken 411 

Tet: 0559-72-4121 


KOREA 
intel Semiconductor Asia Lid. 
Singsong 8th Floor #906 


Tel. 011-82-2-784-8186 or 6286 
TELEX: K29312 INTELKO 


‘SINGAPORE 
intel K sallelge Ltd. 


{gees 230-7 
RS 
TAIWAN 


Intel Semiconductor Lid 
Rm. 808, Min Chi Bi 
746 Min Sheng East 
Taipei 


“Field Application Location 


INTERNATIONAL DISTRIBUTORS/REPRESENTATIVES 


VLC _S.RL Baralome Mitre 1711 
10 Piso 

1037 Buenos Aires 

Tet: 011-54-1-49-2092 

Telex: 17575 EDARG-AR 


Agent 

‘Soimex internatonal Corporation 
15 Par F Row, Room #1730 
New New York 10038 
Tel ony 406-3052 


Bag 250 
Burwood, Victoria 3125 
(Shipping Address) 

9 Harker Street 
Burwood 

Victoria 3125 

Tet: 011-61-3-288-4044 
TELEX: AA 31261 


Anamon, N.S.W. 2064 

Tel: _011-61-02-438-1855 
TELEX: 26297 

BRAZIL 

Elebra Microelectronica S/A 
R 5 


04298 - Sao Paulo 
Tel: 011-55-11-274-9945 
TELEX: 1132864 


1-56-2-277-564 
Telex 352-0003 


No Novel, Precision Machinery Co., Lid 
it ingstor Bidg. 
Phase 1 26 Kwai Hei Street NT 


Hong Ki 
Tet o11-882-5-223222 
TWX 39114 JINMI HK 


CHINA (Cont'd) 


Schmidt & Co. Lid 
18/F. Great Eagle Centre 
Wanchai 


Hong Ki 

Tel o11-882-5-822-0222 
TWX: 74766 SCHMC HK 
HONG KONG 


Schmidt & Co. Lid 
18/F. Great Eagle Centre 
Wanchai 

Tet: 011-852-5-822-0222 
TWX. 74766 SCHMC HK 


Micronic Devices 
65 Arun Complex 
D V G Road 
Basavan Gudi 


Bangalore 560 004 
Tet: _011-91-812-600-631 
TELEX: 011-5947 MDEV 


Micronic Devices 
104/109C Nirma! industrial Estate 
Sion (E) 

Bombay 400 022 

Tel. _011-91-22-48-61-70 

TELEX: 011-71447 MDEV IN 


Sunnyvale, CA 94086 
Tel; (408) 733-8767 


Asahi Electronics we ee 
Room 41 


KMM 
2-14-1 pan Rokuralata: Ku 


Kitakyushu 802 
Tet: (093) Sweat 
TELEX: AECKY 7126-16 


C_ toh 
OS 85 Bidg. 2-6-5 Suda-Cho 
Kanda cay Tokyo 101 
Tel: (03) 


TELEX: (03) feiss 3774 


JAPAN (Cont'd) 


Roe Electric Corporation 
Shuwa Sakurabashi Bidg 
4-5-4 Hatchobori 

Chuo-Ku, Tokyo 104 

Tet: (03) 555-4811 


oa Electron M9 

wu Nomura 

1-26-2 Nishi-Shinjuku 
Shinjuku-Ku, Tokyo 160 

Tel. (03) 343-4 

TELEX: 232- 2200, "LaBTEL J 


Seoul 1 
Tel: _011-82-2-782-8039 
TELEX: KODIGIT K25299 


Koram Digital USA (Agent) 

14066 East Firestone ro 
Sante Fe Si CA 90670 

Tel: (714) 739-2204 

TELEX: 194715 KORAM DIGIT LSA 
Samsung 


23rd Fi. 
1502-KA poet ios: pre 
ae Ku 


To’ 777-78 
TELEX 27970 KORSST K 


(408) 980-1630 


DICOPEL S.A 
Tochti 368 Fracc. Ind. Sn. Antonio 


02760-Mexico, DF 

Tel: 90115255613211 
TELEX: 1773790 DICOME 
Northrup instruments & Systems Ltd. 
459 Kyber Pass Road 

P.O. Box 9464, 

Auckland 1 

Tel, O11-64-9-501-219, 501-801, 587- 
TELEX: NZ21570 THERMAL 


Northrup instruments & Systems Lid 
PO. Box 2406 

856658 
NZ3380 


PAKISTAN 


Computer ications Lid. 
70 Gizn Bosevara 
Defence 

Karachi-46 
Tel,_011-92-21-530-306 
TELEX: 24434 GAFAR PK 


Horizon Training Co.. Inc. (Agent) 
1 Lat 


Tel 128 2) 887-1900 1900, 


SINGAPORE 
General Engineers Corporation Pty 
Utd. 


203 Henderson Road 

1102 Henderson Industrial Park 0315 
Tel: _011065-271-3163 

TELEX: RS23987 GENERCO 


SOUTH AFRICA 
Electronic Building Elements. Pty. Lid 
Bobo Address) 
x one 
Ter oF 011. oS 12-469921 
TELEX: 3-22786 SA 
Shipping Address) 
Sine Square, 18th Street 
Pretona 


TAIWAN 


ration 
Ne ows Wg Sheng €. Road 


1370 011-96-2-501-8231 
TELEX: 11942 TAIAUTO 


Mecte! international, Inc. (Agent) 
3385 Viso Court 

Santa Clara, CA 95050 

Tel: (408) 988-4513 

TWX: 910-338-2201 

FAX: 408-960-9742 


cod Jose, California 95150 
(408) 978-8000 
Telex 278-559 


“Field Application Location 


a I 
INTEL CORPORATION, 3065 Bowers Ave., Santa Clara, CA 95051; Tel. (408) 987-8080. 


INTEL CORPORATON (U.K.) Ltd., Swindon, United Kingdom; Tel. (0793) 488 388. 


INTEL JAPAN k.k., Ibaraki-ken; Tel. 029747-8511 
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